This how-to explains how Microsoft 365 administrators can trace messages to diagnose mail delivery issues, audit activity, and maintain compliance.
Operators are only able to view and manage mailboxes that are part of their defined V-Tenant scope.
- Go to “Reports > Exchange > Message Trace”. Or use the search bar at the top—type “Trace” to find the report.
- Specify your criteria:
-
Sender or Recipient (enter or select email addresses):
- Sender(s): type or choose one or more senders from within your organization.
- Recipient(s): type or choose one or more recipients.
- Date range (typically limited to 10 days; your tenant may require date selection before searching to improve performance).
- Use Advanced Filters for further refinement (e.g., subject, status).
- Once completed, click on the “Search” option to run the query.
- Click on the “MessageTraceID” arrow to view message details.
Message statuses
- Delivered: the message was successfully sent to the recipient.
- Expanded: a distribution group was expanded before delivery to members.
- Failed: the message wasn't delivered.
- Pending: delivery of the message is being attempted or reattempted.
- Quarantined: the message was quarantined (as spam, bulk mail, or phishing). For more information, see the Microsoft documentation article Quarantined email messages in cloud organizations.
- Filtered as spam: The message was identified as spam, and was rejected or blocked (not quarantined).