How to Run a Message Trace in Microsoft 365 to Find a Lost Email

Someone asks whether their email arrived. You check the logs. That sequence is why message trace exists in Microsoft 365 — a report that shows exactly what happened to a specific email at each hop through your mail infrastructure, and whether it was delivered, filtered, failed, or redirected to quarantine.

The tool lives in the Exchange Admin Center, not in Outlook or the main Microsoft 365 admin portal. If you have navigated to the wrong place before, that is why. This guide covers where to find message trace, how to scope a search precisely, and how to read the status codes that tell you what actually happened to the message.

What you need before you start a message trace#

Message trace is an admin tool. You need at least the Exchange Administrator role, or a Microsoft 365 role with equivalent mail flow access — Global Administrator and Security Administrator with Mail.Read both qualify. Standard users cannot run a trace on their own mailbox through this interface.

Before you open the tool, gather at least one piece of identifying information: the sender address, the recipient address, the approximate send time, or a Message-ID if you can pull it from the email headers. A trace submitted with no filters returns everything in Exchange Online's logs, which is slow and difficult to parse. Narrow it before you submit.

Also know the retention window upfront. Standard message trace covers the last 10 days. For emails older than that, you need an extended trace, which covers up to 90 days but runs asynchronously and delivers results as a downloadable report rather than an interactive table.

How to run a message trace in the Exchange Admin Center#

The steps below follow the current Exchange Admin Center layout. Microsoft periodically updates the interface; if a label is slightly different, the underlying function is the same.

1. 1

   1. Open the Exchange Admin Center

   Go to admin.exchange.microsoft.com and sign in with an account that has Exchange administrator access. This is a separate URL from the main Microsoft 365 admin center at admin.microsoft.com — message trace does not live there.

2. 2

   2. Navigate to Mail flow, then Message trace

   In the left navigation, expand Mail flow. In the submenu, click Message trace. If the sidebar is collapsed, look for the Mail flow icon and expand it.

3. 3

   3. Start a new trace

   The Message trace page lists any previous trace requests you have run. Click Start a trace to open the search form.

4. 4

   4. Enter senders and recipients

   Add at least one sender address or one recipient address. Both fields are optional individually, but you need at least one to get focused results. Adding both narrows the trace to messages that match both. Multiple addresses are allowed in each field.

5. 5

   5. Set the time range

   Standard trace supports a window of up to 10 days. Set Start time and End time around when the message was expected. Narrow the window as much as you can — a 10-day range on a busy domain returns thousands of rows. For messages older than 10 days, the trace will run asynchronously and deliver a downloadable report.

6. 6

   6. Add optional filters

   Filter by delivery status (Delivered, Failed, Filtered as spam, Pending, Expanded, Quarantined), subject line, or Message-ID. Message-ID filtering is the most precise option — it pins the trace to a single message even if the same sender and recipient exchange many emails per day. Copy the Message-ID from the original email's internet headers.

7. 7

   7. Submit and read the results

   Click Search. Results appear as a table showing sender, recipient, subject, received time, and delivery status. Click any row to expand the delivery events — the hop-by-hop log of what happened to that message. The status codes in those events tell you whether the message was delivered, filtered, rejected, or still in queue, and at which point in the chain.

What the message trace delivery status codes mean#

The status column carries most of the diagnostic value. Each code answers a different question, and misreading one — particularly confusing Filtered with Failed — sends you to look in the wrong place.

The most important distinction to keep straight is Delivered versus Filtered. A Delivered status means Exchange Online considers its job done — the message is in the mailbox, and whatever happened next (inbox rule, manual delete, client-side Junk sorting) is not recorded in message trace. A Filtered status means the message arrived at Exchange Online but was redirected before it reached the inbox. One is a post-delivery problem; the other is a filter policy problem, and the fix for each is different.

Standard trace vs extended trace: which to use#

The choice between a standard and an extended trace comes down to how old the message is and whether you need results immediately.

For most investigations, the standard trace is enough and should be your first step. If the message is older than 10 days, start an extended trace with the same sender, recipient, and date filters, enter a notification email address for the download link, and expect to wait a few minutes to a few hours depending on mail volume. Exchange Online allows up to 10 simultaneous trace report requests per organization. If a colleague already ran the same query, the download may already be in the list.

What to do when the trace returns no results#

A trace that returns nothing does not necessarily mean the message never arrived. It more often means the search parameters do not match the log entry. Before concluding delivery failed, work through four checks.

First, verify the exact email addresses. A single transposed character means the log entry exists under a different address than the one you searched. Copy addresses directly from email headers rather than from memory or an auto-completed field.

Second, widen the time window. If the sender and recipient remember the send date approximately, extend both ends of the range by 24 hours and re-run. A message that appears to have arrived late in one time zone may have been logged under a different UTC timestamp.

Third, check whether the trace returns Delivered and the problem is actually post-delivery. A Delivered status means Exchange Online placed the message in the mailbox. The recipient's inbox rules, their Junk folder, or the Focused Inbox filter may have moved or deleted it afterward — events that message trace does not capture.

Fourth, for messages that return Filtered or Quarantined, the message exists in the system. It is in the wrong location, not missing. Release it from quarantine or adjust the spam filter policy for that sender to reduce future false positives.

A faster way: reduce the need for traces upstream#

Message trace is a reactive tool. Someone reports a missing email; an admin investigates. The lag and the admin time are both costs of a filter that generates false positives on legitimate mail — the same category of message that tends to account for the majority of trace requests.

We build AI Emaily. Its spam protection layer classifies on sender behavior and domain signals rather than address matching alone, so a legitimate sender that rotates sending infrastructure does not keep triggering the same false positive. For anyone who needs a readable record of what happened to each message without opening the Exchange Admin Center, AI Emaily's audit log shows exactly what the assistant did — filed, flagged, routed, or approved — for every message it handled. If your team logs recurring 'where did that email go' questions, that combination of a more accurate filter and a transparent activity trail is worth a look. Start a 7-day free trial at aiemaily.com, or compare what each plan includes at aiemaily.com/pricing.