Track Messages in Office 365

At times, you may need to find out what happened to an email that was processed by the Office 365 service. Exchange Online provides the ability to trace messages for up to 90 days from the date they were processed.

Start a Message Trace

Message traces can be started in the Security & Compliance Center for the Office 365 tenant you wish to trace on.

  1. Log into the tenant's Office 365 Security & Compliance Center using global admin details:
  2. Go to ‘Mail Flow > Message trace’
  1. Select Start a trace
  1. Select the conditions for search you want to perform:
  • By these people – the email address or user that sent the email
  • To these people – The email address(es) or user(s) who received the emails
  • Within this time range – The timescale to perform the search against

  1. Press Search

Note: If you attempt to perform a search that goes back past 10 days, your trace will be requested and you will need to return back to download it once it has completed. An email notification will be sent to confirm once this has completed.

Understanding Message Traces

Message traces can show a lot of information about an email. Some of the information that may not be immediately obvious is described below.

Message Status


The email was delivered to the specified mailbox or recipient server


The email has not yet been delivered – The delivery will be re-attempted


The email was sent to a group and was distributed to that group’s members


The email was not delivered – The Message Events will show more information

Filtered as Spam

The email was handled as spam – Depending on your settings, this will either routed to Junk or rejected


The email is held by the Exchange Online Quarantine service and is pending release

Getting Status

The email is still being processed by Office 365, the status will be updated shortly – The email may have already been delivered

Message Events




The email was received for processing by the Exchange Online service


The email was sent on by the Exchange Online service


The email could not be passed on to the next step – An error message will confirm the reason for this


The email was delivered to the recipient mailbox


The email was sent to a group and was distributed to that group’s members


The email delivery was delayed – An error message will show the reason for the delay


The recipient address was updated – Generally occurs when an email is sent to an alias

More Information

Message ID

A unique identifier for the email

From IP

The IP address of the source of the email as it is passed to Office 365


The IP address of the next hop the email was passed to

Note: Message traces can also be ran via Exchange Admin Centre > Mail Flow.