Microsoft Exchange - Perform Email Search and Deletion flow

  • Release version: Washingtondc
  • Updated August 1, 2024
  • 5 minutes to read

    • When the Microsoft Exchange - Perform Email Search and Deletion flow is executed, it searches the Exchange server using the search query provided, and returns the details to the on-premises instance.

    Before you begin

    Role required: sn_si.analyst

    About this task

    The Microsoft Exchange - Perform Email Search and Deletion flow is executed when email searches are set up and the Delete from Email Server(s) or Search on Email Server(s) button are pressed.

    Actions specific to this integration are described here. For more information on other actions, see Common integration workflow activities.

    The flow actions include:

    Create Compliance Search Action

    The Create Compliance Search action creates a compliance search for emails in the designated Exchange server(s) using the search queries defined and returns the name of compliance search created.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    search_query Mandatory search query used to find emails in the Exchange Server across all mailboxes.
    exchange Location Mandatory location field used to search across location defined. Values are:
    • All
    • Name of specific mailbox
    targetId Mandatory target host identifier field where the Exchange Server is located.

    Output variables

    The output variables contain data that can be used in subsequent actions.

    Table 1. Output variables
    Variable Description
    response Name of the compliance search created.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 2. Exit Conditions
    Variable Description
    Search Creation Failed When search creation fails due to exception in exchange server.
    Search Created Successfully When search creation is successful.
    Search Creation Failed due to a Parsing Error When search creation fails due to parsing issue.
    Error When exception occurs in flow action.

    Check Compliance Search Status Action

    The Check Compliance Search Status action check the status of created compliance search on exchange server and if the status is completed return the information regarding email search found for the compliance search.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.

    Output variables

    The output variables contain data that can be used in subsequent actions.

    Table 3. Output variables
    Variable Description
    response Contains status of the compliance search and number of emails found on the exchange server for the compliance search.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 4. Exit Conditions
    Variable Description
    Search In Progress When status of compliance search is in progress.
    Search Complete - No Threat Emails Found When status of compliance search is completed, and no emails are found as a part of compliance search.
    Search Complete - Threat Emails Found When status of compliance search is completed, and emails are found as a part of compliance search.
    Error Checking Status When status checking fails due to exception in exchange server.
    Error When exception occurs in flow action.

    Create Compliance Search Preview Action

    The Create Compliance Search Preview Action creates a new compliance search action of type preview on the exchange server for the created compliance search.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 5. Exit Conditions
    Variable Description
    Complete When compliance search action is successfully created.
    Error Creating Action When creation of compliance search action fails due to exception in exchange server.
    Error When exception occurs in flow action.

    Check Preview Action Status

    The Preview Action Status checks the status of compliance search action of type preview and returns the preview information of the emails found like recipient, sender, subject, email date received.

    Input variables

    Input variables determine the initial behavior of the activity.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.

    Output variables

    The output variables contain data that can be used in subsequent actions.

    Table 6. Output variables
    Variable Description
    response Contains the status of compliance search action and the preview information of the email found as a part of compliance search.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 7. Exit Conditions
    Variable Description
    Preview in Progress When status of compliance search action is in progress.
    No Mail Found When status of compliance search action is completed, and no emails are found as a part of compliance search.
    Preview Complete When status of compliance search action is completed, and emails are found as a part of compliance search.
    Error Checking Status When status checking fails due to exception in exchange server.
    Error When exception occurs in workflow activity.

    Create Compliance Search Delete Action

    The Create Compliance Search Delete Action creates a new compliance search action of type purge on the exchange server for the created compliance search.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 8. Exit Conditions
    Variable Description
    Complete When compliance search action is successfully created.
    Error Creating Action When creation of compliance search action fails due to exception in exchange server.
    Error When exception occurs in flow action.

    Check Delete Action Status

    The Check Delete Action Status checks the status of compliance search action of type purge and performs soft delete operation on the exchange server for the emails found as a part of compliance search.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.

    Output variables

    The output variables contain data that can be used in subsequent actions.

    Table 9. Output variables
    Variable Description
    response Contains the status of compliance search action and count of emails deleted, which were found as a part of compliance search.

    Exit Conditions

    Possible exit conditions for this action are:

    Table 10. Exit Conditions
    Variable Description
    Delete in Progress When status of compliance search action is in progress.
    No Mail Found When status of compliance search action is completed, and no emails are deleted as a part of compliance search.
    Delete Complete When status of compliance search action is completed, and emails are deleted as a part of compliance search.
    Error Checking Status When status checking fails due to exception in exchange server.
    Error When exception occurs in flow action.

    Remove Compliance Search Action

    The Remove Compliance Search action removes the created compliance search from exchange server.

    Input variables

    Input variables determine the initial behavior of the action.

    Variable Description
    targetId Mandatory target host identifier field where the Exchange Server is located.
    searchName Mandatory name of compliance search created on exchange server.