Announcing Public Preview of the New Message Trace in Exchange Online

[Windows Server]

Today, we are excited to announce that the Public Preview of the new Message Trace in the Exchange admin center (EAC) in Exchange Online will begin rolling out mid-December and is expected to be completed by the end of December 2024. Admins will soon be able to access the new Message Trace and its capabilities by default when navigating to the Exchange admin center > Mail flow > Message Trace.

As illustrated in the image below, the new Message Trace will be toggled “on” by default once the change has been deployed to your tenant. If you wish to disable the preview, you can do so by toggling this setting to “off.”  

Key UI functionality changes

• Extended Query Range: You can now query up to 90 days of historical data for near real-time queries. However, please note that you can only query 10 days’ worth of data at a time. Please note that you will initially only have 30 days of historical data for near real-time query, and this will build over time to 90 days of historical data.  
• Subject Filter: The subject filter for Message Trace queries is now available, supporting "starts with", "ends with", and "contains" functions. This filter also supports special characters.
• Delivery Status Filter: The delivery status filter will now support searches for "Quarantined", "Filtered as spam", and "Getting status" statuses.

Additional UI updates based on feedback

• Customizable Columns: For your search results, we’ve introduced customizable columns and added additional column options that you can select from. Please refer to the image below for the new columns that have been added.
• Persistent Column Widths: You will be able to customize your column-widths, and these changes will be sticky per logged-on admin account, so they will not have to be reset every time you run a new message trace query.
• Wider Flyout Option: An option for a wider flyout for the Message Trace detail is now available.
• Time Zone Consistency: Message Trace will now default to the time zone set in the Exchange account settings of the logged-on admin.

Key cmdlet changes from Get-MessageTrace

• Extended Query Range: Ability to query up to 90 days of historical data. However, please note that you will only be able to query 10 days’ worth of data per query. Please note that you will initially only have 30 days of historical data for near real-time query, and this will build over time to 90 days of historical data.  
• Subject Parameter: The addition of a subject parameter allowing for more specific Message Trace queries.
• No Page number or Page size parameter:  There will not be pagination support in the new Message Trace cmdlet.
• Result size parameter: The new Message Trace will support a default value of 1000 results and a maximum of 5000 results (set via the -ResultSize parameter), which is a significant increase.  This change is to ensure fair use of our resources, as pagination can create performance issues for our system.
• StartingRecipientAddress parameter: This parameter’s main use is to assist in pulling subsequent data while minimizing duplication.

Since pagination will no longer be supported, you can utilize the EndTime parameter with the EndTime of the last record of the query results and fill in the StartingRecipientAddresss parameter with RecipientAddress of the last record of the previous result. See the example below for more details.

Example of differences between V1 and V2:

For the sample data above, you can pull the first 10 records by either query:

Old Message Trace:

Get-MessageTrace -StartTime '2024-11-01T00:00:00Z' -EndTime '2024-11-01T00:10:00Z' -Page 1 -PageSize 10

New Message Trace:

Get-MessageTraceV2 -StartTime '2024-11-01T00:00:00Z' -EndTime '2024-11-0100:10:002' - ResultSize 10

To pull the next subsequent records, you could use either of the following queries.  In the V2 example below, we are using the StartingRecipientAddress of last recipient (r_1_010@contoso) from the previous results.

Old Message Trace:

Get-MessageTrace -StartTime '2024-11-01T00:00:00Z' -EndTime '2024-11-01T00:10:00Z' -Page 2 -PageSize 10

New Message Trace:

Get-MessageTracev2 -StartTime '2024-11-01T00:00:00Z' -EndTime '2024-11-01T00:10:00Z' -ResultSize 10 -StartingRecipientAddress r_1_010@contoso.com

Known differences and on-going updates

• Message trace V1 normalizes all recipients to lowercase, while V2 keeps them the same as in Message Tracking Logs.
• When displaying the results, V2 will order by ReceivedTime in descending order first, then RecipientAddress in ascending order(case-insensitive).
• In some rare cases, FromIp may be missing in V2, but we are working to fix this issue.
• For messages with over 1000 recipients, admins must include the MessageTraceId in both the EAC and PowerShell cmdlet queries to avoid partial results.
• For quarantine scenarios, V2 will display the latest status while V1 displayed the original status. So if the email is quarantined initially and then released by the administrator later, Message Trace v2 will show the latest status which is delivered to Mailbox.

Microsoft 365 Messaging Team

View the full article