skip to Main Content

Searching “hidden” Email addresses Using PowerShell | Office 365 | Part 11#13

In the current article, we review the process in which we use PowerShell for creating a search in Office 365 and Exchange Online environment, looking for a “hidden” or “ghost” E-mail address.

The term “ghost E-mail address” is not a technical term but instead, a term that I use for describing a scenario in which we need to locate a specific E-mail that we cannot find by using the standard Exchange Online web management interface.

An example to such as case could be a scenario in which we want to add an E-mail address to Exchange Online recipient, and we get an error message that informs us that the E-mail address is associated with another recipient.

The challenge that we face is – how to locate the “hidden recipient” that own this E-mail address.

Looking for Exchange Online with a specific Alias or E-mail address

Using a PowerShell script for implementing a “unified search” of E-mail address | Exchange Online + Office 365 infrastructure

The PowerShell query that we use for locating the E-mail address is based on the PowerShell “Where statement”.

The PowerShell Where statement, define a “search condition” that address Exchange Online recipient and Office 365 users.

  • Regarding Exchange Online recipient, we will query the property – EmailAddresse
  • Regarding Office 365 user account, we will query the property ProxyAddresses and
    the property – UserPrincipalName

In the article – Searching Email addresses with a specific domain name suffix Using PowerShell | Office 365 | Part 10#13, include more detailed information about the search scope in Office 365 and the PowerShell cmdlets that we use regarding the subject of PowerShell command that uses the “Where statement” and the structure of the command, you can read the article – Searching for an Email addresses using PowerShell | Where Filter | Office 365 | Part 9#13

The following PowerShell command performs a search for a specific E-mail address by “addressing” all the Exchange Online recipients (the PowerShell command Get-Recipient).

The Where statement addresses the “EmailAddresses property” of the Exchange Online recipient, and look for a text string “*”.

Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*"} | FL DisplayName,EmailAddresses

Notice that we use the PowerShell operator “Like” that doesn’t perform an “exact match”.
Although that technically we can use the PowerShell operator “eq” (equal), I prefer to use the PowerShell operator “Like” because in Office 365 based environment, the “E-mail address” that we look for can “reveal” as:

  • SMTP E-mail address
  • SIP E-mail address
  • Office 365 UPN name

If we will use the PowerShell operator “eq” (equal), we will need to provide the “exact string” that we look for.
For example, if we want to look for “bob E-mail address” we will need to use a syntax such as:
Where {$_.EmailAddresses -eq “”}

Using a PowerShell script for performing a “unified search”, looking for a specific E-mail address or specific UPN name.

To the purpose of the following PowerShell script is, helping us to perform a “unified” search, that will query – Azure Active Directory infrastructure, and Exchange Online infrastructure.

  • The script “address” all the available Exchange Online recipients and Office 365 users, and query the specific properties that include information about E-mail address or UPN name.
  • The PowerShell script uses the “Where statement”, that defines the search query condition – looking for a
    specific E-mail address. (when executing the script, you will need to type the “E-mail address” that you look for).
  • In case that PowerShell find Office 365 user or Exchange Online recipient that uses the specific E-mail address, the information will be displayed on the screen.

Using a Menu based PowerShell script.

If you are “afraid” from the complex syntax, I have prepared easy to use Menu based PowerShell script.

The PowerShell script will help you to create the required remote PowerShell connection to Azure Active Directory + Exchange Online, and execute the required search by selecting the specific menu number.

In the article – How to use the PowerShell script – manage Email addresses in Office 365 | Part 13#13, you can find more detailed information about how to use the Menu based PowerShell script.

Creating a remote PowerShell session.

You will need to create a remote PowerShell session with Azure Active Directory (Office 365) + Exchange Online.

In case you are not familiar with this process you can read the articles:

Searching for specific E-mail address | search scope = Exchange Online

This following PowerShell script example, perform a search that addresses only Exchange Online infrastructure

The search addresses all existing Exchange Online recipients and searches for a
specific E-mail address E-mail address.

$Alias = Read-Host "Type the name of the E-mail address that you are looking for "

# Exchange Online infrastructure

$SoftDeleted = Get-Mailbox -SoftDeletedMailbox | Where {$_.EmailAddresses -like "*$Alias"}
$UnifiedGroups = Get-UnifiedGroup | Where {$_.EmailAddresses -like "*$Alias"}
$AllRecipients = Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like "*$Alias"}
if ($SoftDeleted -eq $null)
write-host "The E-mail address $Alias, is not a Soft Deleted Exchange Online mailbox"
write-host --------------------------------------------------------
write-host "The E-mail address $Alias, belong to Unified Group"
write-host Recipient display name is- $AllRecipients.DisplayName
write-host Recipient E-mail addresses are - $AllRecipients.EmailAddresses
write-host Recipient Type is - $AllRecipients.RecipientType
write-host -------------------------------------------------------

if ($UnifiedGroups -eq $null)
write-host "The E-mail address $Alias, is not a Unified Group"
belong to Soft Deleted Exchange Online  mailbox

if ($AllRecipients -eq $null)
write-host "The E-mail address $Alias, is not Exchange Online recipient "

write-host --------------------------------------------------------
write-host "The E-mail address $Alias, belong to Exchange Online Recipient"
write-host Recipient display name is- $AllRecipients.DisplayName
write-host Recipient E-mail addresses are - $AllRecipients.EmailAddresses
write-host Recipient Type is - $AllRecipients.RecipientType
write-host -------------------------------------------------------

The next article in the current article series

Remove Email addresses using PowerShell | Office 365 | Part 12#13

The o365info Team

The o365info Team

This article was written by our team of experienced IT architects, consultants, and engineers.

This Post Has One Comment

  1. If I could suggest an improvement, it’s to use the “-filter” capability of Get-Recipient instead of the Where clause.  Filtering means the Office365 server does the searching and only sends you the accounts that match the filter, whereas the Where clause means Office365 sends you ALL of the accounts in your tenant and your local Powershell has to crawl through them looking for a match.  Probably not a huge difference if you’ve only got a few dozen accounts, but if you’ve got hundreds or thousands, it makes an enormous difference.

    So instead of
    Get-Recipient -ResultSize unlimited| Where {$_.EmailAddresses -like “*”} | FL DisplayName,EmailAddresses

    Get-Recipient -Filter { EmailAddresses -like “*” } | FL DisplayName,EmailAddresses

Leave a Reply

Your email address will not be published. Required fields are marked *