Searching “hidden” Email addresses Using PowerShell | Office 365 | Part 11#13 5/5 (3)

6 min read
In the current article, we review the process in which we use PowerShell for creating a search in Office 365 and Exchange Online environment, looking for a “hidden” or “ghost” E-mail address.


The term ““ghost E-mail address” is not a technical term but instead, a term that I use for describing a scenario in which we need to locate a specific E-mail that we cannot find by using the standard Exchange Online web management interface.

An example to such as case could be a scenario in which we want to add an E-mail address to Exchange Online recipient, and we get an error message that informs us that the E-mail address is associated with another recipient.

The challenge that we face is – how to locate the “hidden recipient” that own this E-mail address.

Looking for Exchange Online with a specific Alias or E-mail address

Using a PowerShell script for implementing a “unified search” of E-mail address | Exchange Online + Office 365 infrastructure

The PowerShell query that we use for locating the E-mail address is based on the PowerShell “Where statement”.

The PowerShell Where statement, define a “search condition” that address Exchange Online recipient and Office 365 users.

  • Regarding Exchange Online recipient, we will query the property – EmailAddresse
  • Regarding Office 365 user account, we will query the property ProxyAddresses and
    the property – UserPrincipalName
In the article – Searching Email addresses with a specific domain name suffix Using PowerShell | Office 365 | Part 10#13, include more detailed information about the search scope in Office 365 and the PowerShell cmdlets that we use

Regarding the subject of PowerShell command that uses the “Where statement” and the structure of the command, you can read the article – Searching for an Email addresses using PowerShell | Where Filter | Office 365 | Part 9#13

The following PowerShell command performs a search for a specific E-mail address by “addressing” all the Exchange Online recipients (the PowerShell command Get-Recipient).

The Where statement address the “EmailAddresses property” of the Exchange Online recipient, and look for a text string “*bob@o365info.com”.

Notice that we use the PowerShell operator “Like” that doesn’t perform an “exact match”.
Although that technically we can use the PowerShell operator “eq” (equal), I prefer to use the PowerShell operator “Like” because in Office 365 based environment, the “E-mail address” that we look for can “reveal” as:

  • SMTP E-mail address
  • SIP E-mail address
  • Office 365 UPN name

If we will use the PowerShell operator “eq” (equal), we will need to provide the “exact string” that we look for.
For example, if we want to look for “bob E-mail address” we will need to use a syntax such as:
Where {$_.EmailAddresses -eq “smtp:bob@o365info.com”}

Using a PowerShell script for performing a “unified search”, looking for a specific E-mail address or specific UPN name.

To purpose of the following PowerShell script is, helping us to perform a “unified” search, that will query – Azure Active Directory infrastructure, and Exchange Online infrastructure.

  • The script “address” all the available Exchange Online recipients and Office 365 users, and query the specific properties that include information about E-mail address or UPN name.
  • The PowerShell script uses the “Where statement”, that define the search query condition – looking for a
    specific E-mail address. (when executing the script, you will need to type the “E-mail address” that you look for).
  • In case that PowerShell find Office 365 user or Exchange Online recipient that uses the specific E-mail address, the information will be displayed on the screen.

Using a Menu based PowerShell script.

If you are “afraid” from the complex syntax, I have prepared easy to use Menu based Menu based PowerShell script.

The PowerShell script will help you to create the required remote PowerShell connection to Azure Active Directory + Exchange Online, and execute the required search by selecting the specific menu number.

In the article – How to use the PowerShell script – manage Email addresses in Office 365 | Part 13#13, you can find more detailed information about how to use the Menu based PowerShell script.

Creating remote PowerShell session.

You will need to create a remote PowerShell session with Azure Active Directory (Office 365) + Exchange Online.

In case that you are not familiar with this process you can read the articles:

Searching for specific E-mail address | search scope = Exchange Online

This following PowerShell script example, perform a search that addresses only Exchange Online infrastructure

The search addresses all existing Exchange Online recipients and searches for a
specific E-mail address E-mail address.


For your convenience, I have “Wrapped” all the PowerShell commands that were reviewed in the article,
in a “Menu Based” PowerShell Script.

You are welcome to download the PowerShell script and use it.
Download -o365info PowerShell Script

Manage E-mail address using PowerShell script
In case that you need instructions about – how to use the Manage E-mail address PowerShell script menu, you can read the fowling Article.

The next article in the current article series

Remove Email addresses using PowerShell | Office 365 | Part 12#13

Now it’s Your Turn!
It is important for us to know your opinion on this article

Restore Exchange Online mailbox | Article series index

Print Friendly

Related Post

Please rate this

Eyal Doron on EmailEyal Doron on FacebookEyal Doron on GoogleEyal Doron on LinkedinEyal Doron on PinterestEyal Doron on RssEyal Doron on TwitterEyal Doron on WordpressEyal Doron on Youtube
Eyal Doron
Share your knowledge.
It’s a way to achieve immortality.
Dalai Lama

Leave a Reply

Your email address will not be published. Required fields are marked *