/flags/purview/new-compliancesearchaction-purge-purgetype
New-ComplianceSearchAction -Purge -PurgeType SoftDelete or HardDelete
- tool
- Microsoft Purview (Security & Compliance PowerShell)
- command
- New-ComplianceSearchAction
- flag
- -Purge, -PurgeType SoftDelete|HardDelete
- default
- no purge; -PurgeType has no documented default value
New-ComplianceSearchAction -SearchName NAME -Purge -PurgeType SoftDelete deletes the email items found by an existing content search, typically to remove a phishing message from every mailbox after an incident. -PurgeType HardDelete (cloud only) marks them for permanent removal instead. The cmdlet runs in Security & Compliance PowerShell (Connect-IPPSSession) and needs the Search And Purge role.
Connect-IPPSSession -UserPrincipalName admin@contoso.com
New-ComplianceSearch -Name "Phish 2026-10-24" -ExchangeLocation All `
-ContentMatchQuery 'subject:"Invoice overdue" AND from:attacker@example.net'
Start-ComplianceSearch -Identity "Phish 2026-10-24"
Get-ComplianceSearch -Identity "Phish 2026-10-24" | Format-List Status, Items
New-ComplianceSearchAction -SearchName "Phish 2026-10-24" -Purge -PurgeType SoftDelete
Get-ComplianceSearchAction -Identity "Phish 2026-10-24_Purge" | Format-List Status, ResultsThe two purge types
From the cmdlet reference:
| -PurgeType | What happens | Recoverable |
|---|---|---|
| SoftDelete | purged items are recoverable by users until the deleted item retention period expires | yes, from Recoverable Items |
| HardDelete (cloud only) | items are marked for permanent removal and removed the next time the Managed Folder Assistant processes the mailbox | no; with single item recovery, removed after the retention period |
Limits and rules
- 10 items per mailbox per action. "A maximum of 10 items per mailbox can be removed at one time. Because the capability to search for and remove messages is intended to be an incident-response tool, this limit helps ensure that messages are quickly removed from mailboxes. This action isn't intended to clean up user mailboxes."
- 50,000 mailboxes per search. Larger scopes need several searches.
- Unindexed items are not removed.
- Role. In Security & Compliance PowerShell,
-Purgeand-PurgeTypeare available only with the Search And Purge role, assigned by default to the Organization Management and Data Investigator role groups.
Pitfalls
- Check the query first. A purge acts on every match. Read the
Itemscount of the completed search and runNew-ComplianceSearchAction -Previewbefore purging; the search and preview steps are on New-ComplianceSearch. - Confirmation prompt. The cmdlet asks for confirmation; in scripts add
-Confirm:$falseonly after the query is tested. - Holds win. In a mailbox on Litigation Hold, In-Place Hold or with a Microsoft 365 retention policy, a purged message is moved to the Purges folder and retained until the hold duration expires, whichever purge type you use.
- Email only. Microsoft notes that Teams items returned by a content search are not deleted by
-Purge. - Session type. Some eDiscovery cmdlets now need a search-only session; if a cmdlet reports that, reconnect as described on EnableSearchOnlySession required.
- Sovereign clouds. GCC High and DoD connect with the endpoints on Connect-IPPSSession -ConnectionUri.
FAQ
Why are only 10 messages deleted per mailbox?
That is the documented limit of -Purge: a maximum of 10 items per mailbox per action. Run the purge action again until the search finds nothing, or use the Microsoft Graph ediscoverySearch purgeData action, which allows up to 100 items per location.
Can users recover items purged with SoftDelete?
Yes. SoftDelete items are recoverable by users until the deleted item retention period expires. HardDelete marks them for permanent removal the next time the Managed Folder Assistant processes the mailbox.
Which role do I need?
The Search And Purge role. By default it is assigned only to the Organization Management and Data Investigator role groups; eDiscovery Manager alone can search but not purge.