MC959720 - Microsoft Exchange Online: New "Message trace" functionality (public preview)

We are excited to announce the Public Preview of the new version of Message trace in the Microsoft Exchange admin center (EAC) in Microsoft Exchange Online. Admins will soon be able to access the new Message trace and its capabilities by default in the Exchange admin center > Mail flow > Message trace. Also, admins will be able to use the new Message trace functionality using Microsoft PowerShell cmdlet Get-MessageTraceV2 (similar to Get-MessageTrace (ExchangePowerShell) | Microsoft Learn).

The new Message trace will be toggled On by default after being deployed to your tenant. If you wish to disable the preview, you can change the toggle to Off in the Message trace flyout. To use the new Message trace functionality through the PowerShell cmdlet Get-MessageTraceV2, please ensure you are using version 3.7.0 or later of the Exchange Online PowerShell V3 module.

When this will happen:

Public Preview: We will begin rolling out mid-December 2024 and expect to complete by late December 2024.

How this will affect your organization:

Key functionality changes

• Extended query range: You can query up to 90 days of historical data for near real-time queries. However, please note that you can only query 10 days of data at a time. Please note that you will initially only have 30 days of historical data for near real-time query, and this will build over time to 90 days of historical data.
• Subject filter: You can select a subject filter for Message trace queries, such as Starts with, Ends with, and Contains functions. This filter also supports special characters.
• Delivery status filter: The delivery status filter will now support searches for Quarantined, Filtered as spam, and Getting status statuses.

Additional updates

• Customizable columns: For your search results, we’ve introduced customizable columns and added additional column options. Learn more about the new columns.
• Persistent column widths: You will be able to customize your column widths, and these changes will persist in each logged-on admin account, so you will not have to reset column widths each time you run a new Message trace query. This update is still in progress and will be made available in early-February.
• Wider flyout option: An option for a wider flyout for the Message trace detail will be available.
• Time zone consistency: Message trace will default to the time zone set in the Exchange account settings of the logged-on admin.

Key cmdlet changes in Get-MessageTraceV2 (relative to Get-MessageTrace)

• Extended query range: You can query up to 90 days of historical data. However, please note that you will only be able to query 10 days of data per query. Please note that you will initially only have 30 days of historical data for near real-time query, and this will build over time to 90 days of historical data.
• Subject parameter: You can filter by subject for more specific Message trace queries.
• No page number or page size parameter: Pagination will not be supported in Get-MessageTraceV2. This change is to ensure fair use of our resources, as pagination can create performance issues for our system.
• Result size parameter: The new Message trace will support a default value of 1000 results and a maximum of 5000 results (set through the -ResultSize parameter), which is a significant increase.
• StartingRecipientAddress parameter: This parameter’s main use is to assist in pulling subsequent data while minimizing duplication. 

As an alternative to pagination, you can set the EndDate parameter with the Received time of the last record of the previous query results and fill in the StartingRecipientAddresss parameter with the RecipientAddress of the last record of the previous result.

Known differences and ongoing updates

• Message trace V1 normalizes all recipients to lowercase, while V2 retains any capitalization in Message tracking logs.
• When displaying results, V2 will order by Received in descending order first, and then by RecipientAddress in ascending order(case-insensitive).
• In some rare cases, FromIp may be missing in V2, but we are working to fix this issue.
• For messages with over 1000 recipients, admins must include the MessageTraceId in both the EAC experience and PowerShell cmdlet queries to avoid partial results.
• For quarantine scenarios, V2 will display the latest status while V1 displayed the original status. For example, if the email is initially quarantined and then released later by the admin, Message trace v2 will show the latest status that is delivered to mailbox.

What you need to do to prepare:

Learn more: Announcing Public Preview of the New Message Trace in Exchange Online | Microsoft Community Hub (December 16, 2014).

This rollout will happen automatically by the specified date with no admin action required before the rollout. If you face any issues, you can toggle the new Message trace Off to use the old Message trace. You may want to notify your admins about this change and update any relevant documentation.