/commands/exchange-online/get-messagetracev2
Get-MessageTraceV2: message trace in Exchange Online PowerShell
- tool
- Exchange Online PowerShell
- versions
- Exchange Online, ExchangeOnlineManagement 3.x
- os
- windows, linux, macos
Get-MessageTraceV2 replaces Get-MessageTrace for tracing mail through Exchange Online. It searches the last 90 days, returns at most 10 days of data per query and up to 5000 results (default 1000). Connect with Connect-ExchangeOnline first.
Get-MessageTraceV2 -SenderAddress john@contoso.com -StartDate "10/13/2026" -EndDate "10/15/2026"Without any parameter the cmdlet returns only the last 48 hours. Time stamps in the output are UTC.
Common queries
# Messages to one recipient that failed
Get-MessageTraceV2 -RecipientAddress anna@contoso.com -Status Failed -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
# By subject (StartsWith or EndsWith are faster than Contains)
Get-MessageTraceV2 -Subject "Invoice" -SubjectFilterType StartsWith -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date)
# By Message-ID header (include the angle brackets if the header has them)
Get-MessageTraceV2 -MessageId "<d9683b4c-127b-413a-ae2e-fa7dfb32c69d@contoso.com>" -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date)Parameters
| Parameter | Notes |
|---|---|
| -StartDate / -EndDate | Range of at most 10 days, within the last 90 days |
| -SenderAddress / -RecipientAddress | One or more addresses, comma separated |
| -Status | Delivered, Expanded, Failed, FilteredAsSpam, GettingStatus, Pending, Quarantined |
| -Subject / -SubjectFilterType | Contains, StartsWith or EndsWith |
| -MessageId / -MessageTraceId | Message-ID header, or the trace GUID (required for messages to more than 1000 recipients) |
| -FromIP / -ToIP | Source or destination IP address |
| -ResultSize | 1 to 5000, default 1000 (replaces -PageSize of Get-MessageTrace) |
| -StartingRecipientAddress | With -EndDate, continues a partial result without duplicates |
More than 5000 results
The cmdlet has no paging. Take the Recipient address and Received Time of the last row and pass them as -StartingRecipientAddress and -EndDate in the next query:
# First query
$page = Get-MessageTraceV2 -StartDate "10/13/2026" -EndDate "10/15/2026" -ResultSize 5000
$page | Select-Object -Last 1 | Format-List
# Next query: EndDate = Received time of that last row, StartingRecipientAddress = its recipient
Get-MessageTraceV2 -StartDate "10/13/2026" -EndDate "10/14/2026 17:42:10" -StartingRecipientAddress "anna@contoso.com" -ResultSize 5000Repeat until a query returns fewer rows than -ResultSize. Narrowing the date range or adding -SenderAddress or -RecipientAddress is usually simpler than paging.
Microsoft accepts at most 100 queries in a 5-minute window; above that the cmdlet is throttled.
Event details
Get-MessageTraceDetailV2 shows the individual events (receive, spam filter, transport rule, delivery) of one message, using the MessageTraceId and recipient from a Get-MessageTraceV2 row.