Sometimes an email message gets lost in transit, or it can take a lot longer than expected for delivery, and your users can wonder what happened. As an administrator, you can use the message trace feature to follow messages as they pass through your Exchange Online or Exchange Online Protection service. With message trace, you can determine whether a targeted email message was received, rejected, deferred, or delivered by the service. It also shows what events have occurred to the message before reaching its final status. Getting detailed information about a specific message lets you efficiently answer your user's questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.
Tip
For troubleshooting general issues and trends, use the Reports page in the Microsoft Defender portal (https://security.microsoft.com/emailandcollabreport). For single point specifics where details are needed about a message, use the message trace tool.
The following topics describe how to run a message trace to narrow down your search criteria, how to view message trace results, and how to view details about a specific message:
Learn how compliance works in Exchange Online. Learn how to use retention and data loss prevention policies to keep the data and communications you're required to maintain, how to find that data and communications, and how to ensure you're ready for an audit.
If you’re an administrator who deploys and manages Microsoft 365 and performs Microsoft 365 tenant-level implementation and administration of cloud and hybrid environments, this certification is designed for you.