1. Message Trace & Headers for Office 365 Enhancements (Feb 2014)
Microsoft Exchange
3/31/2017
Message Trace & Headers for Office 365 Enhancements (Feb 2014)
Scott Landry
Microsoft Corporation
Support Webcast Series
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Management Surfaces Introduction Microsoft Exchange 3/31/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. Welcome to the webcast
We are recording today’s session, and will have the slide show presentation and the video recording on the original blog post and the Office 365 Community. You can find the video recording on our Video Channel -
Questions can be asked at the end of the presentation through the Lync Meeting Console.
We are recording today’s session, please understand that you may be captured in the recording. If you do not wish to be recorded, please do not type in the Lync IM Window or please leave the meeting.

4. Message Header Analyzer
Microsoft Exchange
3/31/2017
Management Surfaces
Message Header Analyzer
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Message Header Analyzer
Remote Connectivity Analyzer (

6. Message Header Analyzer
New!
Can be added to OWA & Outlook as an app

7. Message Header Analyzer

8. Enhancements to Message Trace
Microsoft Exchange
3/31/2017
Management Surfaces
Enhancements to Message Trace
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Enhancements
Search up to 90 days
Get routing details
New!
New!

10. “Extended” Message Trace
How it works
“Basic” Message Trace
“Extended” Message Trace
(Historical Search)
Data Set
Between approx. 15 minutes & 7 days
Between approx. 8 hours & 90 days
View Results
In UI
Download
Results
In seconds
In minutes/hours (can configure notification address)
Routing Details
Basic detail only
Full detail optional
Maximum Size
500
5,000 (3,000 for detail)
Max Queries / Day
Reasonable limits
15 per tenant
New!
New!

11. Finding Message Trace Go to Exchange Admin Center Click mail flow
Click message trace

12. Using the new functionality
Uses the existing UI which has been slightly modified

13. Using the new functionality
Select “custom” date range
Select start and end date/times – narrower time frames may help
Must specify sender, recipient, or msg id - wildcards ok, but not supported

14. Using the new functionality
After selecting a period outside of 7 days, new options appear
“Include message events and routing details with report”
Notification address

15. Downloading completed traces
Click to see running & completed reports
Reports available for 10 days
Results of 5000 (or for detailed) should not be trusted to be complete (truncated warning message)
Scroll to bottom to download the results

16. Reviewing traces Recommend using Excel DATA -> Filter
Sort by date_time
More information about the fields & value meanings: us/library/bb124375(v=exchg.15 0).aspx

17. PowerShell Basic: Get-MessageTrace, Get-MessageTraceDetail
Extended: Start-HistoricalSearch, Stop-HistoricalSearch, Get-HistoricalSearch
Pull results inside of (and shorter than) 7 days (but still >8 hours)
Search on advanced criteria, like find all messages that hit a particular DLP rule
New!
Start-HistoricalSearch [[-Organization] <OrganizationIdParameter>] -ReportType <HistoricalSearchReportType>
{MessageTrace | MessageTraceDetail | DLP | TransportRule | SPAM | Malware} -ReportTitle <string> -StartDate
<datetime> -EndDate <datetime> [-NotifyAddress <MultiValuedProperty[string]>] [-DeliveryStatus <string>]
[-SenderAddress <MultiValuedProperty[string]>] [-RecipientAddress <MultiValuedProperty[string]>]
[-OriginalClientIP <string>] [-MessageID <MultiValuedProperty[string]>] [-DLPPolicy <MultiValuedProperty[guid]>]
[-TransportRule <MultiValuedProperty[guid]>] [-Locale <cultureinfo>] [-Direction <MessageDirection> {All | Sent |
Received}]

18. What about Delivery Reports?
Microsoft Exchange
3/31/2017
Management Surfaces
What about Delivery Reports?
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

19. Delivery Reports
Admins should NOT rely on this feature – use Message Trace instead
Could eventually be removed from Exchange Admin Center for Office 365
End users will still be able to get Delivery Reports for themselves, however:
Delivery Reports can only be searched for within a few days of message being sent (after which an error may occur)
No immediately planned improvements

20. Scenarios for Message Trace
Microsoft Exchange
3/31/2017
Management Surfaces
Scenarios for Message Trace
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

21. Scenario: Inbound
Check to see if there is any record of the message (if no record, then you’ll need to check with the sender)
Check hygiene results
Look for hints about where it may have gone (forwards, rules, etc.)

22. Scenario: Outbound
Make sure the message was received from Outlook client (if not, troubleshoot Outlook)
Look for SMTP SEND Event

23. Management Surfaces Future Microsoft Exchange 3/31/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Future Remain committed to additional investments to Message Trace
Microsoft Exchange
3/31/2017
Future
Remain committed to additional investments to Message Trace
Top priority: Usability & performance
Goal: bring more detail to “Basic” Message Trace
Search by Subject – still on our radar, no current ETA
Soon - View message headers in quarantine
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Feedback
Please answer the survey questions posted at the end of this meeting.
Let us know what sessions you want! Heather Correa at
Feel free to give feedback too.

26. Management Surfaces Q&A and Feedback Microsoft Exchange 3/31/2017
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Q&A
Feedback received about maximum of 15 queries per day. We will continue to monitor performance and allow additional queries if possible. Support does not currently have access to run queries on behalf of customers except in extreme cases. Consider using e- discovery features for legal discovery matters.
Two questions came up about s blocked by DNS BLs / IP reputation. These s will be rejected at the perimeter, and the sending server must generate an NDR. All of this happens without Office 365 accepting the message or even getting a msg id. Therefore these messages do NOT show up in Message Trace. Messages which are content filtered, do show up im Message Trace. In addition, you can report on both types of rejections using the “Received Spam” Report (note “IP blocked”):
Feedback received about up-to 8 hours to process. This only applies to the new Historical Search feature.

28. 3/31/2017
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.