Skip to content

Searching “hidden” Email addresses Using PowerShell | Office 365 | Part 11#13

In the current article, we review the process in which we use PowerShell for creating a search in Office 365 and Exchange Online environment, looking for a “hidden” or “ghost” E-mail address.

The term “ghost E-mail address” is not a technical term but instead, a term that I use for describing a scenario in which we need to locate a specific E-mail that we cannot find by using the standard Exchange Online web management interface.

An example to such as case could be a scenario in which we want to add an E-mail address to Exchange Online recipient, and we get an error message that informs us that the E-mail address is associated with another recipient.

The challenge that we face is – how to locate the “hidden recipient” that own this E-mail address.

Looking for Exchange Online with a specific Alias or E-mail address

Using a PowerShell script for implementing a “unified search” of E-mail address | Exchange Online + Office 365 infrastructure

The PowerShell query that we use for locating the E-mail address is based on the PowerShell “Where statement”.

The PowerShell Where statement, define a “search condition” that address Exchange Online recipient and Office 365 users.

  • Regarding Exchange Online recipient, we will query the property EmailAddresse
  • Regarding Office 365 user account, we will query the property ProxyAddresses and
  • the property UserPrincipalName

The following PowerShell command performs a search for a specific E-mail address by “addressing” all the Exchange Online recipients (the PowerShell command Get-Recipient).

The Where statement addresses the “EmailAddresses property” of the Exchange Online recipient, and look for a text string “*bob@o365info.com”.

Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*bob@o365info.com"} | FL DisplayName,EmailAddresses

Notice that we use the PowerShell operator “Like” that doesn’t perform an “exact match”.

Although that technically we can use the PowerShell operator eq (equal), I prefer to use the PowerShell operator “Like” because in Office 365 based environment, the “E-mail address” that we look for can “reveal” as:

  • SMTP E-mail address
  • SIP E-mail address
  • Office 365 UPN name

If we will use the PowerShell operator eq (equal), we will need to provide the exact string that we look for.

For example, if we want to look for bob E-mail address we will need to use a syntax such as:

Where {$_.EmailAddresses -eq "smtp:bob@o365info.com"}

Using a PowerShell script for performing a “unified search”, looking for a specific E-mail address or specific UPN name.

To the purpose of the following PowerShell script is, helping us to perform a “unified” search, that will query – Azure Active Directory infrastructure, and Exchange Online infrastructure.

  • The script “address” all the available Exchange Online recipients and Office 365 users, and query the specific properties that include information about E-mail address or UPN name.
  • The PowerShell script uses the “Where statement”, that defines the search query condition – looking for a specific E-mail address. (when executing the script, you will need to type the “E-mail address” that you look for).
  • In case that PowerShell find Office 365 user or Exchange Online recipient that uses the specific E-mail address, the information will be displayed on the screen.

Using a Menu based PowerShell script.

If you are “afraid” of the complex syntax, I have prepared easy to use Manage email addresses in Office 365 PowerShell script.

The PowerShell script will help you to create the required remote PowerShell connection to Azure Active Directory + Exchange Online, and execute the required search by selecting the specific menu number.

Creating a remote PowerShell session.

You will need to Connect to Exchange Online using PowerShell.

Searching for specific E-mail address | search scope = Exchange Online

This following PowerShell script example performs a search that addresses only Exchange Online infrastructure. The search addresses all existing Exchange Online recipients and searches for a specific e-mail address.

$Alias = Read-Host "Type the name of the E-mail address that you are looking for "

# Exchange Online infrastructure
$SoftDeleted = Get-Mailbox -SoftDeletedMailbox | Where { $_.EmailAddresses -like "*$Alias" }
$UnifiedGroups = Get-UnifiedGroup | Where { $_.EmailAddresses -like "*$Alias" }
$AllRecipients = Get-Recipient -ResultSize unlimited | Where { $_.EmailAddresses -like "*$Alias" }

if ($SoftDeleted -eq $null) {
    write-host "The E-mail address $Alias, is not a Soft Deleted Exchange Online mailbox"
}
Else {
    write-host --------------------------------------------------------
    write-host "The E-mail address $Alias, belong to Unified Group"
    write-host Recipient display name is- $AllRecipients.DisplayName
    write-host Recipient E-mail addresses are - $AllRecipients.EmailAddresses
    write-host Recipient Type is - $AllRecipients.RecipientType
    write-host -------------------------------------------------------
}
if ($UnifiedGroups -eq $null) {
    write-host "The E-mail address $Alias, is not a Unified Group"
}
Else {
    belong to Soft Deleted Exchange Online mailbox
}
if ($AllRecipients -eq $null) {
    write-host "The E-mail address $Alias, is not Exchange Online recipient "
}
Else {
    write-host --------------------------------------------------------
    write-host "The E-mail address $Alias, belong to Exchange Online Recipient"
    write-host Recipient display name is- $AllRecipients.DisplayName
    write-host Recipient E-mail addresses are - $AllRecipients.EmailAddresses
    write-host Recipient Type is - $AllRecipients.RecipientType
    write-host -------------------------------------------------------
}

In the next article, we will look at Remove Email addresses using PowerShell | Office 365 | Part 12#13.

o365info Team

o365info Team

This article was written by our team of experienced IT architects, consultants, and engineers.

This Post Has One Comment

  1. If I could suggest an improvement, it’s to use the “-filter” capability of Get-Recipient instead of the Where clause.  Filtering means the Office365 server does the searching and only sends you the accounts that match the filter, whereas the Where clause means Office365 sends you ALL of the accounts in your tenant and your local Powershell has to crawl through them looking for a match.  Probably not a huge difference if you’ve only got a few dozen accounts, but if you’ve got hundreds or thousands, it makes an enormous difference.

    So instead of:
    Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like “*bob@o365info.com”} | FL DisplayName,EmailAddresses

    Use:
    Get-Recipient -Filter { EmailAddresses -like “*bob@o365info.com” } | FL DisplayName,EmailAddresses

Leave a Reply

Your email address will not be published. Required fields are marked *