/commands/purview/new-compliancesearch
New-ComplianceSearch and Start-ComplianceSearch: run a Purview content search in PowerShell
- tool
- Microsoft Purview (Security & Compliance PowerShell)
- versions
- ExchangeOnlineManagement 3.9.0+, Security & Compliance PowerShell
- os
- windows, linux, macos
A content search (compliance search) runs in Security & Compliance PowerShell in three steps: create it, start it, read the result. Since module 3.9.0 the connection must use -EnableSearchOnlySession:
Connect-IPPSSession -UserPrincipalName admin@contoso.com -EnableSearchOnlySession
New-ComplianceSearch -Name "Phishing 2026-10" -ExchangeLocation All `
-ContentMatchQuery 'subject:"Your invoice is ready" AND received>=2026-10-01'
Start-ComplianceSearch -Identity "Phishing 2026-10"
Get-ComplianceSearch -Identity "Phishing 2026-10" | Format-List Name,Status,Items,SizeWait until Status is Completed before reading Items. You need an eDiscovery role, for example membership in the eDiscovery Manager role group.
Search parameters
| Parameter | Value |
|---|---|
| -ExchangeLocation | Mailboxes or distribution groups (email addresses), or All |
| -SharePointLocation | Site URLs, or All |
| -ContentMatchQuery | Keyword Query Language (KQL); without it every item in the locations matches |
| -AllowNotFoundExchangeLocationsEnabled | $true to include inactive mailboxes (address prefixed with a period) without validation |
KQL examples: from:anna@contoso.com, subject:"Quarterly report", 'Patent' AND 'Project Tailspin Toys', received>=2026-10-01.
Preview and purge
New-ComplianceSearchAction -SearchName "Phishing 2026-10" -Preview
New-ComplianceSearchAction -SearchName "Phishing 2026-10" -Purge -PurgeType SoftDelete
Get-ComplianceSearchAction | Format-Table Name,SearchName,Action,Status-Purge removes at most 10 items per mailbox per action and works on up to 50,000 mailboxes per search; unindexed items are not removed. -PurgeType SoftDelete keeps items recoverable until the deleted item retention period ends; HardDelete (cloud only) marks them for permanent removal. Purge needs the Search And Purge role, which by default is only in the Organization Management and Data Investigator role groups.
Exporting search results with New-ComplianceSearchAction -Export works only in on-premises Exchange now; in Microsoft 365 export from the Purview portal.
Sources
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/exchangepowershell/new-compliancesearch
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/exchangepowershell/start-compliancesearch
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/exchangepowershell/get-compliancesearch
- learn.microsoft.comlearn.microsoft.com/en-us/powershell/module/exchangepowershell/new-compliancesearchaction