Extracting Email Addresses from the Last 6 Months

Hi Zayan,

Exchange Online message trace cannot cover the full six months because its retention period is 90 days. The 10-day limit applies to each interactive query, so running additional queries will not retrieve trace data older than 90 days. See Microsoft’s message trace FAQ.

For a six-month address list, one option is to search the messages still available in the user’s mailbox using Microsoft Purview eDiscovery, provided your organization has the required licensing and your account has search and export permissions.

The general approach is:

1. Create an eDiscovery search scoped to the user’s Exchange mailbox and restrict it to email messages within the required six-month period.
2. Review the results to distinguish outgoing and incoming messages using the sender/recipient information, together with the appropriate sent or received dates.
3. Select Export items with items report. This exports the matching messages along with an item report.
4. Open Items.csv in Excel and extract the sender addresses for incoming messages and recipient addresses for outgoing messages. Split multiple-address fields into individual entries, remove display names where needed, and remove duplicates.

Microsoft documents the export process and available metadata fields. The report-only option is smaller, but it can have incomplete metadata and truncates text fields at 255 characters, so it may omit parts of long recipient lists.

This produces a list based on available mailbox content. It cannot guarantee a complete six-month history if relevant messages were permanently deleted and are no longer retained.

Do you have access to Purview eDiscovery, and do you need a unique address list or a message-by-message report?