[GH-ISSUE #186] Feature Request: Remove Malicious Emails from Inboxes/Folders within/across Tenant(s)

kerem commented

2026-03-02 12:03:56 +03:00

Owner

Originally created by @scubes13 on GitHub (Nov 4, 2021).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/186

Is your feature request related to a problem? Please describe.
When a phishing attack targets multiple users at one or more clients, it is often difficult to quickly get rid of the offending emails that were sent to 10's or 100's of users. These emails are just sitting in Inboxes and/or other folders.

Describe the solution you'd like
It would be great to be able to identify an offending email (not sure how to suggest this would look in CIPP) and have the system look for an identical email across tenants that could then be placed into Quarantines, deleted or some other action (whatever is the best practice/suggestion of you all).

Originally created by @scubes13 on GitHub (Nov 4, 2021). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/186 **Is your feature request related to a problem? Please describe.** When a phishing attack targets multiple users at one or more clients, it is often difficult to quickly get rid of the offending emails that were sent to 10's or 100's of users. These emails are just sitting in Inboxes and/or other folders. **Describe the solution you'd like** It would be great to be able to identify an offending email (not sure how to suggest this would look in CIPP) and have the system look for an identical email across tenants that could then be placed into Quarantines, deleted or some other action (whatever is the best practice/suggestion of you all).

kerem

2026-03-02 12:03:56 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-03-02 12:03:57 +03:00

Author

Owner

@freezscholte commented on GitHub (Nov 4, 2021):

@scubes13 you probably mean the use of content search right -> https://compliance.microsoft.com/contentsearchv2?viewid=search

In that case this would be a useful feature however this would be used with great caution! I think from the CIPP portal you only want to allow the -Purge and -Softdelete commands regarding deleting emails that way you could always recover within a certain point of time if something went the way it wasnt supposed to.

Some MS docs:
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide

@freezscholte commented on GitHub (Nov 4, 2021): @scubes13 you probably mean the use of content search right -> https://compliance.microsoft.com/contentsearchv2?viewid=search In that case this would be a useful feature however this would be used with great caution! I think from the CIPP portal you only want to allow the -Purge and -Softdelete commands regarding deleting emails that way you could always recover within a certain point of time if something went the way it wasnt supposed to. Some MS docs: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide

kerem commented

2026-03-02 12:03:57 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Nov 4, 2021):

Risk vs reward is a great point here @freezscholte. We'll discuss this one in the discord before assigning it to a build.

@KelvinTegelaar commented on GitHub (Nov 4, 2021): Risk vs reward is a great point here @freezscholte. We'll discuss this one in the discord before assigning it to a build.

kerem commented

2026-03-02 12:03:57 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Nov 4, 2021):

Trying to find common ground; What if CIPP finds that e-mail, displays the result, and gives you the powershell script that will delete it for all tenants? I'm a little worried about all the implications around mass deletes.

@KelvinTegelaar commented on GitHub (Nov 4, 2021): Trying to find common ground; What if CIPP finds that e-mail, displays the result, and gives you the powershell script that will delete it for all tenants? I'm a little worried about all the implications around mass deletes.

kerem commented

2026-03-02 12:03:58 +03:00

Author

Owner

@freezscholte commented on GitHub (Nov 5, 2021):

Good point @KelvinTegelaar , maybe you could restrict the function only to the admin rol for example and also only allow for example the
New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete

So no -PurgeType Harddelete !! 🗡️ And if you still want a extra confirmation maybe you could send out a mail (or teams webhook message) to the requestor with a pin-code in it. The pin-code would be needed to complete the delete action.

But I think it would be wise to let some more eyes have a look on this one before deciding to implement or not.

@freezscholte commented on GitHub (Nov 5, 2021): Good point @KelvinTegelaar , maybe you could restrict the function only to the admin rol for example and also only allow for example the New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete So no -PurgeType Harddelete !! 🗡️ And if you still want a extra confirmation maybe you could send out a mail (or teams webhook message) to the requestor with a pin-code in it. The pin-code would be needed to complete the delete action. But I think it would be wise to let some more eyes have a look on this one before deciding to implement or not.

kerem commented

2026-03-02 12:03:58 +03:00

Author

Owner

@PsychoData commented on GitHub (Nov 5, 2021):

One thing that I would do with these personally is save an export of them before I purge them, so that if we wanted to review them for security reasons (or manual restore in an emergency) then you could.
so my process in one tenant was

search
preview
export results content
purge HardDelete

@PsychoData commented on GitHub (Nov 5, 2021): One thing that I would do with these personally is save an export of them before I purge them, so that if we wanted to review them for security reasons (or manual restore in an emergency) then you could. so my process in one tenant was - search - preview - export results content - purge HardDelete

kerem commented

2026-03-02 12:03:58 +03:00

Author

Owner

@scubes13 commented on GitHub (Nov 5, 2021):

After a brief review of the Purge options, I could not find any method mentioned by MS regarding pushing the offending emails into Quarantine. In theory, if we could push to Quarantine, we could also have a Best Practice enabled that would only allow an admin to view/release/etc those emails from Quarantine in a tenant. By doing so, the emails wouldn't actually be hard or soft deleted.

Assuming that Quarantine is not an option (and I'm just not missing it), then I too would vote for the soft-delete.

I do like the idea of a PIN/secondary approval step for the process....

@scubes13 commented on GitHub (Nov 5, 2021): After a brief review of the Purge options, I could not find any method mentioned by MS regarding pushing the offending emails into Quarantine. In theory, if we could push to Quarantine, we could also have a Best Practice enabled that would only allow an admin to view/release/etc those emails from Quarantine in a tenant. By doing so, the emails wouldn't actually be hard or soft deleted. Assuming that Quarantine is not an option (and I'm just not missing it), then I too would vote for the soft-delete. I do like the idea of a PIN/secondary approval step for the process....

kerem commented

2026-03-02 12:03:58 +03:00

Author

Owner

@PsychoData commented on GitHub (Nov 5, 2021):

I think the only way to force the emails into quarantine would be to get MS to ZAP them or use Threat Explorer (or rather underlying APIs) to move them to quarantine.... it ... might be possible?
I don't think that that would fall under ComplianceAction then though - that would probably be through Defender APIs

@PsychoData commented on GitHub (Nov 5, 2021): I think the only way to force the emails into quarantine would be to get MS to ZAP them or use [Threat Explorer](https://security.microsoft.com/threatexplorer) (or rather underlying APIs) to move them to quarantine.... it ... might be possible? I don't think that that would fall under ComplianceAction then though - that would probably be through Defender APIs

kerem commented

2026-03-02 12:03:58 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Nov 15, 2021):

for now, we're marking this as something we won't pick up., there's a bit too much dependency on the Exchange modules which slow down usage of the app considerably, combined with the risk/reward aspect. I am considering this for a later version.

@KelvinTegelaar commented on GitHub (Nov 15, 2021): for now, we're marking this as something we won't pick up., there's a bit too much dependency on the Exchange modules which slow down usage of the app considerably, combined with the risk/reward aspect. I am considering this for a later version.

Rows
Columns

[GH-ISSUE #186] Feature Request: Remove Malicious Emails from Inboxes/Folders within/across Tenant(s) #107