Searching Email addresses with a specific domain name suffix Using PowerShell | Office 365 | Part 10#13

In the current article, we review the scenario in which we use PowerShell for searching for an E-mail address with a specific domain name suffix.

In our case, we review a scenario which I defined as “unified search” because that search will “run” on two different Office 365 infrastructures:

1. Exchange Online infrastructure – addressing Exchange Online recipients and searching recipients who have an E-mail address with a specific domain name suffix.
2. Azure Active Directory infrastructure – addressing Office 365 users, whom their UPN name includes or their “Proxy E-mail address” include a specific domain name suffix.

The search scope in Office 365 based environment

Azure Active Directory vs. Exchange Online

Regarding the task of locating specific E-mail addresses in an Office 365 environment, the first thing that we need to define is the “search scope.”

Office 365 is a “logical container” that “hosts” many types of infrastructure such as – the Azure Active Directory, Exchange Online, Skype for business and so on.

Most of the time, when we need to look for a specific E-mail address, the main Office 365 infrastructure that we “address” is the Exchange Online infrastructure.

In some scenarios, we need also to perform searches for users UPN names and their E-mail address search in the Azure Active Directory infrastructure.

The importance of defining the required “search scope” in an Office 365 environment is because of the following reasons:

• Remote PowerShell process is implemented differently for each Office 365 infrastructure such as – Azure Active Directory, Exchange Online, etc.
• In each infrastructure, we use PowerShell for addressing different “type of objects.” In the Exchange Online environment, we address “recipient object,” and in an Azure Active Directory environment, we address the “User account” object.
• In each Office 365 environment (Exchange Online, Azure Active Directory and so on), we use a different type of PowerShell cmdlets.
• The information about E-mail address and UPN name is“located” in different object property (attribute).

Scenario description

Our task is to search (and find) all the “entities” that have the domain name suffix o365info.com.

• In the following section, we review the way that we perform this type of search in Exchange Online environment.
• In the next section, we review the way that we perform this type of search in – Office 365 (Azure Active Directory) environment.

Performing searches for – E-mail address with a specific domain name suffix | Exchange Online infrastructure

In a scenario in which we need to perform a search that will “address” of the available Exchange Online recipients types, looking for E-mail addresses with a specific domain name suffix, we need to use a combination of the following three PowerShell commands:

• Get-Recipient
• Get-Mailbox -SoftDeletedMailbox
• Get-UnifiedGroup

The Get-Recipient command

The main PowerShell cmdlet that we use for getting information about most of the Exchange Online recipients is the PowerShell command Get-Recipient.

Get-Recipient

The PowerShell command Get-Recipient is a powerful command that can address almost all the available type of Exchange Online recipients.

Using the Get-Recipient command, can “replace” the need for using the following PowerShell commands:

• Get-Mailbox
• Get-Contact
• Get-MailContact
• Get-MailUser
• Get-User
• Get-MailPublicFolder
• Get-DistributionGroup
• Get-DynamicDistribution

Deleted Exchange Online mailboxes

Deleted Exchange Online mailboxes are stored in Exchange Online recycle bin.

To be able to look for information about “Soft Deleted Exchange Online mailboxes,” we need to use an additional PowerShell command Get-Mailbox -SoftDeletedMailbox.

Exchange Online Unified group recipients

Theoretically, the PowerShell command Get-Recipient was supposed to get information about 100% of the Exchange Online recipients.

At the current time, the command Get-Recipient doesn’t “know” how to address Exchange Online recipients, that described as – “Exchange Online Unified group.”

To be able to address Exchange Online “Unified groups,” we need to use an additional
PowerShell cmdlet Get-UnifiedGroup.

if you want to read more information about the various types of Exchange Online recipients, and the PowerShell cmdlets that we use for addressing a different type of recipients; you can read the article – Introduction to the various type of Exchange Online recipients | PowerShell cmdlets | Office 365 | Part 8#13

Performing a search for an E-mail address that includes a specific domain name suffix | Search scope – all Exchange Online recipient types.

Looking for E-mail address | Search scope – All Exchange Online recipients

Using the PowerShell command Get-Recipient, we can “address” all the existing Exchange Online recipient (besides on the exception of deleted Exchange Online mailboxes and Unified Group).

In the following section, we demonstrate how to use PowerShell command that uses the Where statement which define a specific search condition.

In our scenario, the Where statement defines a condition, in which we query the EmailAddresses property of the Exchange Online recipient, looking for a text string that includes the domain name suffix that we look for.

An example of the PowerShell command syntax that we use could be:

Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

The PowerShell command performs the following tasks:

• Address all the type of Exchange recipients.
• Query the recipient’s property named EmailAddresses.
• Looking for the text string *@o365info.com.

If you want to read more information about the PowerShell “Where statement” that we use for
searching E-mail address, read the article – Searching for an Email addresses using PowerShell | Where Filter | Office 365 | Part 9#13

Looking for Soft Deleted Exchange Online Mailboxes E-mail address

To query Exchange Online about recipients who defined as – Soft Deleted Exchange Online mailboxes, meaning – Exchange Online mailboxes that “reside” in the Exchange Online recycle bin, we will need to use the PowerShell command Get-Mailbox + the parameter -SoftDeletedMailbox.

The following PowerShell command will query all the Exchange Online Soft Deleted Exchange Online mailboxes, looking for recipients who have the E-mail address with the domain
name suffix – “@o365info.com.”

Get-Mailbox -SoftDeletedMailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Looking for Exchange Online Unified Groups E-mail address

To query Exchange Online about -recipients who defined as – Unified Groups, we need to use a “dedicated PowerShell cmdlet Get-UnifiedGroup.

The following PowerShell command will query all the Exchange Online unified groups, looking for recipients who have the E-mail address with the domain name suffix o365info.com.

Get-UnifiedGroup| Where {$_.EmailAddresses -like "*@o365info.com"}| FL DisplayName,EmailAddresses

Performing searches for – user UPN or user E-mail address with a specific domain name suffix | Azure Active Directory infrastructure

To accomplish the task of – performing a “complete search” in Office 365 (Azure Active Directory) environment, looking for:

1. Office 365 User UPN name.
2. Office 365 user E-mail addresses.

We need to use a combination of two PowerShell commands:

• Get-Msoluser
• Get-MsolUser -ReturnDeletedUsers

Looking for UPN name and E-mail address of Soft Deleted Office 365 users account.

The “basic” PowerShell cmdlet Get-Msoluser, will get us all the required information about “active” Office 365 user accounts, but will not get information about Office 365 user accounts that consider as Soft Deleted Office 365 user accounts.

To perform a search that will access the Azure Active Directory recycle bin (the store of Soft Deleted user accounts), we need to use the basic PowerShell cmdlet Get-Msoluser + an additional parameter in the following way Get-MsolUser -ReturnDeletedUsers.

Performing a search for UPN Name and E-mail address that includes a specific domain name suffix | Search scope – every Office 365 users accounts.

Given that we want to perform the search also in the Azure Active Directory environment, we need to perform a search that will “cover” the following areas:

1. Address all the existing Office 365 user accounts
The meaning is – all the “active” Office 365 user accounts + all the Soft Deleted Office 365 users accounts that are stored in the Azure Active Directory recycle bin.

2. Address two different properties
In our scenario, we would like to find:

• Office 365 user accounts, that there UPN name includes the domain name suffix – “o365info.com.” To be able to find this information, we address the Office 365 useraccount property UserPrincipalName
• Office 365 user accounts, that their E-mail address includes the domain name suffix – “o365info.com.” To be able to find this information, we address the Office 365 user account property ProxyAddresses

Looking for Office 365 user UPN name | Active Office 365 user accounts

To get information about the “UPN name” of Office 365 users, we “query” the Office 365 user
property UserPrincipalName.

The PowerShell command performs the following tasks:

• Address every Office 365 users accounts.
• Query the recipient’s property named UserPrincipalName.
• Looking for the text string *@o365info.com.

Get-Msoluser -all | Where {$_.UserPrincipalName -like "*@o365info.com"} | FL DisplayName,UserPrincipalName

Looking for Office 365 user E-mail address | Active Office 365 user accounts

To get information about Office 365 users E-mail addresses, we “query” the Office 365 user
property ProxyAddresses.

The following PowerShell command will query every Office 365 users account, looking for an Office 365 user account that has E-mail addresses that include the domain name suffix – “@o365info.com.”

Get-Msoluser -all | Where {$_.ProxyAddresses -like "*@o365info.com"} | FL DisplayName,UserPrincipalName, ProxyAddresses

Soft Deleted Office 365 user accounts

To look for information about Office 365 user accounts that located in the Azure Active Directory recycle bin (Soft Deleted user accounts), we use the PowerShell command.

Get-MsolUser -ReturnDeletedUsers

Looking for Office 365 user UPN name | Soft Deleted Office 365 user accounts.

To look for a UPN name of Soft Deleted Office 365 users, we use the
PowerShell command Get-MsolUser -ReturnDeletedUsers, and “query” the Office 365
user property UserPrincipalName.

The following PowerShell command will query every Office 365 Soft Deleted user’s accounts, looking for an Office 365 users accounts that their UPN name includes the domain
name suffix “@o365info.com”.

Get-MsolUser -ReturnDeletedUsers | Where {$_.UserPrincipalName -like "*@o365info.com"} | FL DisplayName,UserPrincipalName

Looking for Office 365 user E-mail address | Soft Deleted Office 365 user accounts

To look for an E-mail address on – Soft Deleted Office 365 user accounts, we use the PowerShell command Get-MsolUser -ReturnDeletedUsers, and “query” the Office 365 properties ProxyAddresses

The following PowerShell command will query every Office 365 Soft Deleted user accounts, looking for an Office 365 users accounts that their E-mail addresses include the domain
name suffix “@o365info.com”.

Get-MsolUser -ReturnDeletedUsers | Where {$_.ProxyAddresses -like "*@o365info.com"} | FL DisplayName,UserPrincipalName , ProxyAddresses

Using a PowerShell script for performing a search of – E-mail address, with a specific domain name suffix | Exchange Online

The task description

• We need to perform a search that will locate all the Exchange Online recipients, who have an E-mail address with a specific Domain name suffix.
• We want that the PowerShell “results” will be saved in a CSV file.

The characters and the logic of the PowerShell script

1. The Domain name suffix we look for.
   The PowerShell script will “ask” us about the specific Domain name suffix we look for. The information will be stored in a variable named $DomainSuffix.
2. Exported file’s location
   In our specific demonstration, we ask from PowerShell to create for us, a NEW folder using the following path: C:\INFO\E-mail address\Exchange Online\E-mail address with Domain suffix $Domainsuffix
3. Exported files
   As mentioned, to be able to get a “view” of all the existing Exchange Online recipients, we need to use three different PowerShell cmdlets Get-Recipient, Get-Mailbox -SoftDeletedMailbox and Get-UnifiedGroup. The output from each command will be stored in a separated CSV file.

$DomainSuffix = Read-Host "Type the domain name suffix that you look for"
# Creating folder structure and file names for the exported CSV files
$A20 = "C:\INFO\E-mail address\Exchange Online\E-mail address with Domain suffix - $Domainsuffix"

if (!(Test-Path -path $A20))
{New-Item $A20 -type directory}

# Exchange Online infrastructure
# Define the variable for the different type of Exchange Online recipients

$AllRecipients = Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*@$DomainSuffix"}
$SoftDeleted = Get-Mailbox -SoftDeletedMailbox | Where {$_.EmailAddresses -like "*@$DomainSuffix"}
$UnifiedGroups = Get-UnifiedGroup | Where {$_.EmailAddresses -like "*@$DomainSuffix"}
if ($SoftDeleted -eq $null)
{
write-host "There are no Soft Deleted Exchange Online mailboxes that have an E-mail address with the domain name suffix - $DomainSuffix"
}
else
{
$SoftDeleted | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online Soft Deleted mailboxes that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($UnifiedGroups -eq $null)
{
write-host "There are no Exchange Online unified groups that have an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$UnifiedGroups | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online unified groups that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($AllRecipients -eq $null)
{
write-host "There are no Exchange Online Recipients that have an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$AllRecipients | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online recipients that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}

Using a PowerShell script for implementing a “unified search” of an E-mail address and UPN name with a specific domain name suffix

The purpose of the following PowerShell script is, to help us to perform a “unified” search, that will query – Azure Active Directory infrastructure, and Exchange Online infrastructure.

• The script “address” all the available Exchange Online recipients and Office 365 users, and query the specific properties that include information about E-mail address or UPN name. The PowerShell script uses the “Where statement” that define the search query condition – looking for an E-mail address with a specific domain name suffix. (when executing the script, you will need to type the “domain name” that you look for).
• The information about Exchange Online recipient and Office 365 users who answer the condition (user and recipients with the specific Domain name suffix), will be exported to a CSV file.
• The PowerShell script will create a folder named INFO in drive C: and save the CSV files in this path.

Using a Menu based PowerShell script.

If you are “afraid” from the complex syntax, I have prepared easy to use Menu based PowerShell script.

The PowerShell script will help you to create the required remote PowerShell connection to Azure Active Directory + Exchange Online, and execute the required search by selecting the specific menu number.

In the article – How to use the PowerShell script – manage Email addresses in Office 365 | Part 13#13, you can find more detailed information about how to use the Menu based PowerShell script.

Creating a remote PowerShell session

You will need to Connect to Exchange Online using PowerShell.

Searching for an E-mail address with a specific Domain name suffix | Search scope “unified search” (Exchange Online +Azure Active Directory).

This following PowerShell script example, perform a “unified search” that address:

1. Exchange Online infrastructure.
2. Azure Active Directory infrastructure.

The search addresses different Exchange Online recipient type and Azure Active Directory users, and search for information about – E-mail address or Office 365 user UPN name that “answer” the condition.

$DomainSuffix = Read-Host "Type the domain name suffix that you look for"
# Creating folder structure and file names for the exported CSV files
$A20 = "C:\INFO\E-mail address\Exchange Online\E-mail address with Domain suffix - $Domainsuffix"
$A21 = "C:\INFO\E-mail address\Azure Active Directory\E-mail address with Domain suffix - $Domainsuffix"
if (!(Test-Path -path $A20))
{New-Item $A20 -type directory}
if (!(Test-Path -path $A21))
{New-Item $A21 -type directory}

# Exchange Online infrastructure
# Define the variable for the different type of Exchange Online recipients

$AllRecipients = Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*@$DomainSuffix"}
$SoftDeleted = Get-Mailbox -SoftDeletedMailbox | Where {$_.EmailAddresses -like "*@$DomainSuffix"}
$UnifiedGroups = Get-UnifiedGroup | Where {$_.EmailAddresses -like "*@$DomainSuffix"}
if ($SoftDeleted -eq $null)
{
write-host "There are no Soft Deleted Exchange Online mailboxes that have an E-mail address with the domain name suffix - $DomainSuffix"
}
else
{
$SoftDeleted | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online Soft Deleted mailboxes that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($UnifiedGroups -eq $null)
{
write-host "There are no Exchange Online unified groups that have an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$UnifiedGroups | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online unified groups that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($AllRecipients -eq $null)
{
write-host "There are no Exchange Online Recipients that have an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$AllRecipients | Select DisplayName,EmailAddresses,RecipientType,RecipientTypeDetails | Export-CSV $A20\"Exchange Online recipients that their E-mail address include the domain name suffix $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}

# Azure Active Directory infrastructure
# Define the variable for the Office 365 users

# Office 365 users - UPN name
$Office365UsersUpn = Get-Msoluser -all | Where {$_.UserPrincipalName -like "*@$DomainSuffix"}
$Office365UsersUpnDell = Get-MsolUser -ReturnDeletedUsers | Where {$_.UserPrincipalName -like "*@$DomainSuffix"}

# Office 365 users - Proxy E-mail address
$Office365UsersEmail = Get-Msoluser -all | Where {$_.ProxyAddresses -like "*@$DomainSuffix"}

$Office365UsersEmailDell = Get-MsolUser -ReturnDeletedUsers | Where {$_.ProxyAddresses -like "*@$DomainSuffix"}
if ($Office365UsersUpn -eq $null)
{
write-host "There are Office 365 users that their UPN name include the domain name suffix - $DomainSuffix"
}
Else
{
$Office365UsersUpn | Select DisplayName,UserPrincipalName | Export-CSV $A21\"Office 365 users that their UPN name include the domain name suffix - $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($Office365UsersUpnDell -eq $null)
{
write-host "There are no Soft Deleted Office 365 users that their UPN name include the domain name suffix - $DomainSuffix"
}
Else
{
$Office365UsersUpn | Select DisplayName,UserPrincipalName | Export-CSV $A21\"Soft Deleted Office 365 users that their UPN name include the domain name suffix - $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}

# Office 365 users Proxy Addresses
if ($Office365UsersEmail -eq $null)
{
write-host "There are no Exchange Online Recipients that include an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$Office365UsersEmail |Select DisplayName,UserPrincipalName,@{Name=“ProxyAddresses”;Expression={$_.ProxyAddresses}} | Export-CSV $A21\"Office 365 users that their Proxy E-mail include the domain name suffix - $DomainSuffix.CSV" –NoTypeInformation -Encoding utf8
}
if ($Office365UsersEmailDell -eq $null)
{
write-host "There are no Exchange Online Recipients that include an E-mail address with the domain name suffix - $DomainSuffix"
}
Else
{
$Office365UsersEmailDell |Select DisplayName,UserPrincipalName,@{Name=“ProxyAddresses”;Expression={$_.ProxyAddresses}} | Export-CSV $A21\"Soft Deleted Office 365 users that their Proxy E-mail include the domain name suffix - $DomainSuffix.CSV.CSV" –NoTypeInformation -Encoding utf8
}

Performing searches for – E-mail address with a specific domain name suffix | Addressing specific recipient type | Exchange Online infrastructure

In the previous section, we mentioned that the PowerShell command Get-Recipient enables us to address almost all the available types of Exchange Online recipients besides Soft Deleted Exchange Online mailboxes and unified groups.

In some scenarios, we need to address a specific Exchange Online “recipient type” such as Exchange Online user mailbox or Exchange Online contact recipient.

In the following section, we review an example of a PowerShell query that addresses only specific types of Exchange Online recipients, looking for an E-mail address that has a specific domain name suffix.

If you want to read more information about the various types of Exchange Online recipients, and the PowerShell cmdlets that we use for addressing a different type of recipients; you can read the article – Introduction to the various type of Exchange Online recipients | PowerShell cmdlets | Office 365 | Part 8#13

In our example, we are looking for Exchange Online recipients whom their E-mail address includes the domain name suffix – “o365info.com.”

Exchange Online recipient type – Mailbox recipient | Get-Mailbox

Exchange Online recipient type – Contact recipient | Get-Contact

Get information about Exchange Online Mailbox recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-Mailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Mail Contact recipient | Get-MailContact

Get information about Exchange Online Contact recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-Contact | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Mail user recipient | Get-MailUser

Get information about Exchange Online Mail Contact recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-MailContact| Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Mail user recipient | Get-User

Get information about Exchange Online Mail user recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-MailUser| Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Mail user recipient | Get-MailPublicFolder

Get information about Exchange Online Public Folder recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-User | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Distribution Group recipient | Get-DistributionGroup

Get information about Exchange Online Distribution Group recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-MailPublicFolder| Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type – Distribution Group recipient | Get-DynamicDistributionGroup

Get information about Exchange Online Distribution Group recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-DistributionGroup | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

Exchange Online recipient type –Dynamic Distribution Group recipient | Get-DynamicDistributionGroup

Get information about Exchange Online Dynamic Distribution Group recipients, that include an E-mail address with a specific domain name suffix.

PowerShell command example:

Get-DynamicDistributionGroup| Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

The next article in the current article series

Searching “hidden” Email addresses Using PowerShell | Office 365 | Part 11#13