O365 - Security And Compliance - Search And Delete Deprecated

Deprecated. Use the Microsoft Graph Security - Search And Delete Emails playbook instead. This playbook performs the following steps: 1. Creates a compliance search. 2. Starts a compliance search. 3. Waits for the compliance search to complete. 4. Gets the results of the compliance search. 5. Gets the preview results, if specified. 6. Deletes the search results (Hard/Soft).

Microsoft Exchange Online · 19 tasks · 12 inputs · 0 outputs

Inputs

  • search_name — The name of the compliance search.
  • case — The name of a Core eDiscovery case to associate with the new compliance search.
  • kql — Text search string or a query that is formatted using the Keyword Query Language (KQL).
  • description — Description of the compliance search.
  • allow_not_found_exchange_locations — Whether to include mailboxes other than regular user mailboxes in the compliance search. Default is "false".
  • exchange_location — Comma-separated list of mailboxes/distribution groups to include, or use the value "All" to include all.
  • exchange_location_exclusion — Comma-separated list of mailboxes/distribution groups to exclude when you use the value "All" for the exchange_location parameter.
  • force — Whether to replace the existing search. If "true", the existing search will be removed and a new search will be created. If "false", the existing search will be used and any new search configurations will be ignored.
  • preview — Whether to preview the results using the search action "Preview". Possible values are: "true" and "false" or leave empty to select manually.
  • delete_type — Specify the delete type to perform on the search results. Possible values are Hard and Soft or leave empty to select manually. (Hard = Unrecoverable, Soft=Recoverable)
  • search_action_polling_timeout — Amount of time to poll before declaring a timeout for the search action and resuming the playbook (in minutes).
  • search_action_polling_interval — The frequency that the polling command will run for the search action that was chosen.

Commands used

o365-sc-remove-search o365-sc-remove-search-action

Flowchart

yes Manual step - Preview Preview Skip Preview Skip Hard Manual step - delete soft Hard Skip Soft User Input Start Start Emails found? Emails found? Done Done Remove search - o365-sc-remove-search Remove search o365-sc-remove-search Remove search action - o365-sc-remove-search-action Remove search action o365-sc-remove-search-action O365 - Security And Compliance - Search - O365 - Security And Compliance - Search O365 - Security And Compl... O365 - Security And Complianc... Whether to preview the results. Whether to preview the re... Manually select whether to preview the search results. Manually select whether t... O365 - Security And Compliance - Search Action - Preview - O365 - Security And Compliance - Search Action - Preview O365 - Security And Compl... O365 - Security And Complianc... Should the search action delete the results? Should the search action ... Which type of delete do you want to perform? Which type of delete do y... O365 - Security And Compliance - Search Action - Delete - O365 - Security And Compliance - Search Action - Delete O365 - Security And Compl... O365 - Security And Complianc... O365 - Security And Compliance - Search Action - Delete - O365 - Security And Compliance - Search Action - Delete O365 - Security And Compl... O365 - Security And Complianc... Error - Preview parameter - PrintErrorEntry Error - Preview parameter PrintErrorEntry Error - delete_type parameter - PrintErrorEntry Error - delete_type param... PrintErrorEntry Remove compliance search - o365-sc-remove-search Remove compliance search o365-sc-remove-search From where should emails be searched and deleted? From where should emails ... Set all mailboxes to be searched - Set Set all mailboxes to be s... Set Set the "email to" as the mailbox to search - Set Set the "email to" as the... Set