Solved: How do I execute message trace in Office 365 based on the subject line?

Question

How do I run a message trace in Microsoft Office 365 to search by subject line?

Solution

Try this to find all messages with a particular subject in the last 24 hours:

$dateEnd = get-date
$dateStart = $dateEnd.AddHours(-24)

$count = Get-MessageTrace -StartDate $dateStart -EndDate $dateEnd | Where {$_.Subject -eq "Phishing attempt"}
$count.Count

or

$dateEnd = get-date
$dateStart = $dateEnd.AddHours(-24)

$count = Get-MessageTrace -StartDate $dateStart -EndDate $dateEnd | Where {$_.Subject -eq "Phishing attempt"}
$count.Count

In my test tenant, my subject searching using this syntax is currently working. Also try to filter on different subjects that are present to see if the problem appears for all subject searching.

If you’re trying to search for a subject %LIKE% then use -match instead of -eq.

Reference

• Microsoft Docs > Blog Archive > EOP Field Notes > Message Trace, the PowerShell Way