Searching for an Email addresses using PowerShell | Where Filter | Office 365 | Part 9#13 5/5 (3) 8 min read

The current article we review the PowerShell command syntax, that we use for “constructing” a query, for searching specific E-mail address using the PowerShell WhereFilter.

The thing that we need to know before we start the search for E-mail address

In this section, I would like to briefly review the main points that relate to the task of performing a search for E-mail addresses in an Office 365 environment.

1. Where to perform the search?
As mentioned, in an Office 365 environment is a “mesh” of different environment that constructs the logical term “Office 365.”

The information that we look for can be associated with Office 365 users who are located in the Azure Active Directory or, associated with Exchange Online recipients that are hosted at the Exchange Online infrastructure.

So, the first question that we need to answer is “where” we want to perform the search?

2. Exchange Online | What are the “recipients type” that we want to query?
Exchange Online includes a substantial number of different recipient’s type.

In a utopian world, we could use one “magical” PowerShell cmdlet, that will help us to scan and fetch information about all the existing Exchange Online recipients. The reality is a little more complicated because, unfortunately, there is no such command.

To be able to address all the available Exchange Online recipient, we will need to use a “Mixture” of PowerShell cmdlets that will address different types of Exchange Online recipients.

3. The term “E-mail address”
In the Office 365 environment, the term “E-mail address,” can be translated to a wide range of “address,” that use an identical naming structure as the “SMTP E-mail address.”

For example,

  • Office 365 user login name (UPN) is based on the naming structure of smtp E-mail addresses.
  • SIP address (Skype for business users) uses the same naming structure of smtp E-mail addresses.
  1. What PowerShell syntax to use for performing the search?

In the current article, we will use the PowerShell “Where statement” as a tool for performing a query, that will scan existing Office 365 objects (Office 365 user account and Exchange Online recipient), and “fetch” for us the object that answers specific criteria.

The E-mail address as a “Text string.”

PowerShell offers many methods for implementing the task of – looking for a specific “text string.” In our scenario, the “text string” that we look for is an “E-mail address.”
When we say that we are looking for an E-mail address, the term “E-mail address” can be realized as:

  • The “Left part” of an E-mail address. This is that part that includes the recipient Alias name. We relate to the “left part” of the E-mail address when we look for information about specific Alias name\s.
  • The “Right part” of an E-mail address. This is the part that includes the domain name suffix. We relate to the “Right part” of E-mail address when we look for information
    about E-mail address with a specific domain name.
  • The “right part” + the “left part.” We relate to the booth of the E-mail address parts, in a scenario in which we search for a specific E-mail address.

The structure of E-mail address -01

Using PowerShell for searching a specific E-mail address using the Where statement

In the following diagram, we can see a basic structure of a PowerShell command, in which we look for E-mail addresses that have a specific domain name suffix.

The “PowerShell query” is created by using the Where filter.

The basic structure of PowerShell Where filter

The different “parts” of the PowerShell command syntax

Part 1#4 – Exchange Online recipient object

The part of PowerShell Where filter looking for specific E-mail address -01

The first part is the part in which we select the specific Exchange Online recipient. In our example, the Exchange recipient “type” is Exchange mailbox.

Part 2#4 – The Where filter

In this part, we use the PowerShell “Where” statement + the definition of the “query filter” or in other words- the “search condition.”

The PowerShell Where statement, include the following parts:

The part of PowerShell Where filter looking for specific E-mail address -02

To perform the required search, that defines a condition in which we search only for E-mail address that has a specific character such as – specific domain name suffix, we use the PowerShell statement – “Where

The PowerShell query “resides” between the curly brackets.

The definition of the Where filter - The query

In our scenario, we query the Azure Active Directory infrastructure + Exchange Online infrastructure.

  • When we query Exchange Online infrastructure, we “address” the Exchange Online recipient property named – “EmailAddresses”.
  • When we query Azure Active Directory infrastructure, we “address” the Office 365 user property named – “UserPrincipalName” and the property “ProxyAddresses“.

The PowerShell operator whom we use.

In a scenario in which we look for a specific E-mail address, we can choose a couple of options of the “PowerShell operators” that we use.

For example, we can use the PowerShell operator – “eq” (equal) or the PowerShell operator “like.”

The PowerShell operator “Like” as the name implies, we search for E-mail addresses that are “like” the E-mail address that we provide.

In our specific scenario, an Exchange Online recipient could “use” the specific E-mail address
as an “SMTP E-mail address” or “SIP address.”

For example, when using the PowerShell operator “like,” looking for the following E-mail addresses Bob@o365info.com, the PowerShell command display result if she finds SMTP E-mail address that includes that “search string” or SIP address that includes the “search string.”

In case that we use the Comparison Operators “like,” we must use the asterisk character (*)

  • To be able to define a condition, in which we want to find a text string that “begin” with defined characters, but we don’t know how it “end,” we will add the asterisk character (*) at the end of the text string that we “provide” to the PowerShell command.
  • To be able to define a condition, in which we want to find a text string that “end” with defined characters, but we don’t know how it “begin,” we will add the asterisk character (*) at the begging of the text string that we “provide” to the PowerShell command.

PowerShell search for E-mail address using where -02

As we can see in the picture, the PowerShell operator “Like” and the asterisk character (*) are good friends.

The PowerShell Comparison Operator - Like and Asterisk character

Another example of PowerShell operator whom we can use is the operator – “eq” (equal).

When we want to “tell” PowerShell that we want to perform a search that looks for a “perfect match,” we use the operator – “eq” (equal).

For example, in case that we want to look for the following E-mail – Bob@o365info.com but display information only if the address is an smtp address, we will use the following PowerShell syntax:

PowerShell search for E-mail address using where -03

Note – if you fill “overloaded” from all the information and the various searches that we need to perform, I have created a PowerShell menu based script named –
Manage E-mail address.ps1, that will simplify the task of searching for an E-mail address with a specific domain name suffix.

Additional reading

Part 3#4 – the displayed object properties “fields”

PowerShell search for E-mail address using where -04

Each of the recipient objects such as – Exchange Online mailbox have many properties.

After the Where filter gets the required information, (in our case, an Exchange recipient who answers a specific condition), the “PowerShell output” displays recipient or a recipient list.

Each of the recipients will be displayed + using “predefined object properties.”

Most of the time, we would like to change this “default,” and “inform” PowerShell, what are the specific recipient properties (attributes) that are relevant for us.

For example, in a scenario in which we look for recipients who have a specific E-mail address, the main properties that are relevant for us are:

  • The recipient name such as – Display name.
  • The type of the recipient (Recipienttype) such as mailbox user or contact.
  • The E-mail addresses that are associated with the specific recipient.

To “inform” the PowerShell command, what are the specific properties that we wish to display (or export), we use PowerShell parameters such as – Select, FL (Format List) or FT (Format Table).

Each of the “properties” that we wish to display, will be separated by a comma character.

PowerShell search for E-mail address using where -05

Part 4#4 – Export the results.

PowerShell search for E-mail address using where -06

By default, the results from the PowerShell query displayed on the PowerShell console.

Regarding the task of – getting information about Exchange Online recipients E-mail address (or Office 365 UPN name), in many scenarios, we will need to export the information to files.”

Storing the information in files, enable us to “manipulate” the data by using filters, specific views and in addition, edit and manage the data.

To export the information about E-mail address, the was created from the PowerShell Where filter, we will need to provide the specific file type that we need such as – CSV, TXT or HTML.

PowerShell search for E-mail address using where -07


For your convenience, I have “Wrapped” all the PowerShell commands that were reviewed in the article,
in a “Menu Based” PowerShell Script.

You are welcome to download the PowerShell script and use it.
Download -o365info PowerShell Script

Manage E-mail address using PowerShell script
In case that you need instructions about – how to use the Manage E-mail address PowerShell script menu, you can read the fowling Article.

Now it’s Your Turn!
It is important for us to know your opinion on this article

Restore Exchange Online mailbox | Article series index

Print Friendly

Related Post

Please rate this

Eyal Doron on EmailEyal Doron on FacebookEyal Doron on GoogleEyal Doron on LinkedinEyal Doron on PinterestEyal Doron on RssEyal Doron on TwitterEyal Doron on WordpressEyal Doron on Youtube
Eyal Doron
Share your knowledge.
It’s a way to achieve immortality.
Dalai Lama

Leave a Reply

Your email address will not be published. Required fields are marked *