Ask Learn
PreviewAsk Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign inThis cmdlet is available in on-premises Exchange and in the cloud-based service. Some parameters and settings might be exclusive to one environment or the other.
Use the New-ComplianceSearchAction cmdlet to create actions for content searches in Exchange Server and in Microsoft Purview.
Note: Several of the parameters on this cmdlet are functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.
New-ComplianceSearchAction
[-SearchName] <String[]>
[-Export]
[-ActionName <String>]
[-ArchiveFormat <ComplianceExportArchiveFormat>]
[-Confirm]
[-FileTypeExclusionsForUnindexedItems <String[]>]
[-EnableDedupe <Boolean>]
[-ExchangeArchiveFormat <ComplianceExportArchiveFormat>]
[-Force]
[-Format <ComplianceDataTransferFormat>]
[-IncludeCredential]
[-IncludeSharePointDocumentVersions <Boolean>]
[-JobOptions <Int32>]
[-NotifyEmail <String>]
[-NotifyEmailCC <String>]
[-ReferenceActionName <String>]
[-Region <String>]
[-Report]
[-RetentionReport]
[-RetryOnError]
[-Scenario <ComplianceSearchActionScenario>]
[-Scope <ComplianceExportScope>]
[-SearchNames <String[]>]
[-SharePointArchiveFormat <ComplianceExportArchiveFormat>]
[-ShareRootPath <String>]
[-Version <String>]
[-WhatIf]
[<CommonParameters>]
New-ComplianceSearchAction
[-SearchName] <String[]>
[-Preview]
[-ActionName <String>]
[-Confirm]
[-Force]
[-Format <ComplianceDataTransferFormat>]
[-IncludeCredential]
[-JobOptions <Int32>]
[-ReferenceActionName <String>]
[-Region <String>]
[-RetryOnError]
[-Scenario <ComplianceSearchActionScenario>]
[-SearchNames <String[]>]
[-Version <String>]
[-WhatIf]
[<CommonParameters>]
New-ComplianceSearchAction
[-SearchName] <String[]>
[-Purge]
[-PurgeType <ComplianceDestroyType>]
[-ActionName <String>]
[-Confirm]
[-Force]
[-Format <ComplianceDataTransferFormat>]
[-IncludeCredential]
[-JobOptions <Int32>]
[-Region <String>]
[-ReferenceActionName <String>]
[-RetryOnError]
[-Scenario <ComplianceSearchActionScenario>]
[-SearchNames <String[]>]
[-Version <String>]
[-WhatIf]
[<CommonParameters>]
After you create a content search using the New-ComplianceSearch cmdlet and run it using the Start-ComplianceSearch cmdlet, you assign a search action to the search using the New-ComplianceSearchAction cmdlet.
In on-premises Exchange, this cmdlet is available in the Mailbox Search role. By default, this role is assigned only to the Discovery Management role group.
You need to be assigned permissions before you can run this cmdlet. Although this article lists all parameters for the cmdlet, you might not have access to some parameters if they aren't included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.
In Microsoft 365, the account that you use to run this cmdlet must have a valid Microsoft 365 license assigned.
To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see Permissions in the Microsoft Purview compliance portal.
To use this cmdlet for Purge actions in Security & Compliance PowerShell, you need to meet the following requirements:
New-ComplianceSearchAction -SearchName "Project X" -Preview
This example creates a preview search action for the content search named Project X.
New-ComplianceSearchAction -SearchName "Project X" -Export
This example creates an export search action for the content search named Project X.
Note: This example works only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete
This example deletes the search results returned by a content search named Remove Phishing Message. Unindexed items aren't deleted when you use the Purge parameter.
New-ComplianceSearchAction -SearchName "Case 321 All Sites" -Export -SharePointArchiveFormat SingleZip -ExchangeArchiveFormat PerUserPst -Format FxStream
This example exports the results returned by the content search named "Case 321 All Sites". The search results are compressed and exported to a single ZIP file. If the search included any Exchange locations, the search results are exported as one PST file per mailbox.
Note: This example works only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
Applicable: Security & Compliance
This parameter is available only in the cloud-based service.
The ActionName parameter specifies a name for the content search action. You use this parameter only when you specify multiple content searches in the SearchName parameter.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
This parameter is deprecated and no longer used.
To specify the format for Exchange search results, use the ExchangeArchiveFormat parameter. To specify the format for SharePoint and OneDrive search results, use the SharePointArchiveFormat parameter.
| Type: | ComplianceExportArchiveFormat |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Confirm:$false.This cmdlet has a built-in pause, so use -Confirm:$false to skip the confirmation.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | cf |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Security & Compliance
This parameter is available only in the cloud-based service.
This parameter is reserved for internal Microsoft use.
| Type: | Boolean |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
This parameter is functional only in the cloud-based service.
This parameter requires the Export role in Security & Compliance PowerShell. By default, this role is assigned only to the eDiscovery Manager role group.
The ExchangeArchiveFormat parameter specifies how to export Exchange search results. Valid values are:
To specify the format for SharePoint and OneDrive search results, use the SharePointArchiveFormat parameter.
| Type: | ComplianceExportArchiveFormat |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
This parameter is functional only in the cloud-based service.
This parameter requires the Export role in Security & Compliance PowerShell. By default, this role is assigned only to the eDiscovery Manager role group.
The Export switch specifies the action for the content search is to export the full set of results that match the search criteria. You don't need to specify a value with this switch.
To only return the information about each detected item in a report, use the Report switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
The FileTypeExclusionsForUnindexedItems specifies the file types to exclude because they can't be indexed. You can specify multiple values separated by commas.
| Type: | String[] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
You can use this switch to run tasks programmatically where prompting for administrative input is inappropriate.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
In Security & Compliance PowerShell, this parameter requires the Export role. By default, this role is assigned only to the eDiscovery Manager role group.
The Format parameter specifies the format of the search results when you use the Export switch. Valid values are:
| Type: | ComplianceDataTransferFormat |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The IncludeCredential switch specifies whether to include the credential in the results. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
This parameter is available only in the cloud-based service.
The IncludeSharePointDocumentVersions parameter specifies whether to export previous versions of the document when you use the Export switch. Valid values are:
| Type: | Boolean |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
This parameter is reserved for internal Microsoft use.
| Type: | Int32 |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
In Security & Compliance PowerShell, this parameter requires the Export role. By default, this is assigned only to the eDiscovery Manager role group.
The NotifyEmail parameter specifies the email address target for the search results when you use the Export switch.
The recipient you specify is in the To: field of the message.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
In Security & Compliance PowerShell, this parameter requires the Export role. By default, this role is assigned only to the eDiscovery Manager role group.
The NotifyEmailCC parameter specifies the email address target for the search results when you use the Export switch.
The recipient you specify is in the Cc: field of the message.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
In Security & Compliance PowerShell, this parameter requires the Preview role. By default, this role is assigned only to the eDiscovery Manager role group.
The Preview switch specifies the action for the content search is to preview the results that match the search criteria. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: In Security & Compliance PowerShell, this switch is available only in the Search and Purge role. By default, this role is assigned only to the Organization Management and Data Investigator role groups.
The Purge switch specifies the action for the content search is to remove items that match the search criteria. You don't need to specify a value with this switch.
A maximum of 10 items per mailbox can be removed at one time. Because the capability to search for and remove messages is intended to be an incident-response tool, this limit helps ensure that messages are quickly removed from mailboxes. This action isn't intended to clean up user mailboxes.
Tip: To purge more than 10 items, refer to ediscoverySearch: purgeData in the Microsoft Graph API, which allows purging a maximum of 100 items per location.
You can remove items from a maximum of 50,000 mailboxes using a single content search. To remove items from more than 50,000 mailboxes, you need to create separate content searches. For more information, see Search for and delete email messages in your Microsoft 365 organization.
Unindexed items aren't removed from mailboxes when you use this switch.
The value of the PurgeType parameter controls how the items are removed.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: In Security & Compliance PowerShell, this parameter is available only in the Search and Purge role. By default, this role is assigned only to the Organization Management and Data Investigator role groups.
The PurgeType parameter specifies how to remove items when the action is Purge. Valid values are:
| Type: | ComplianceDestroyType |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
This parameter is reserved for internal Microsoft use.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
This parameter is reserved for internal Microsoft use.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
This parameter is functional only in the cloud-based service.
The Report switch specifies the action for the content search is to export a report about the results (information about each item instead of the full set of results) that match the search criteria. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
The RetentionReport switch specifies the action for the content search is to export a retention report. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The RetryOnError switch specifies whether to retry the action on any items that failed without re-running the entire action all over again. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
In Security & Compliance PowerShell, this parameter requires the Preview role. By default, this role is assigned only to the eDiscovery Manager role group.
The Scenario parameter specifies the scenario type. Valid values are:
| Type: | ComplianceSearchActionScenario |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
The Scope parameter specifies the items to include when the action is Export. Valid values are:
| Type: | ComplianceExportScope |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The SearchName parameter specifies the name of the existing content search to associate with the content search action. You can specify multiple content searches separated by commas.
You can find the content search by running the command Get-ComplianceSearch | Format-Table -Auto Name,Status.
| Type: | String[] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | 1 |
| Mandatory: | True |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Security & Compliance
This parameter is available only in the cloud-based service.
The SearchNames parameter specifies the names of the existing content searches to associate with the content search action. You separate the content search names by commas.
You can find content search names by running the command Get-ComplianceSearch | Format-Table -Auto Name,Status.
| Type: | String[] |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
This parameter is functional only in the cloud-based service.
This parameter requires the Export role. By default, this role is assigned only to the eDiscovery Manager role group.
The SharePointArchiveFormat parameter specifies how to export SharePoint and OneDrive search results. Valid values are:
To specify the format for Exchange search results, use the ExchangeArchiveFormat parameter.
| Type: | ComplianceExportArchiveFormat |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE
This parameter is available only in on-premises Exchange.
Note: This parameter is functional only in on-premises Exchange. For more information, see May 2025 changes to Microsoft Purview eDiscovery.
{{ Fill ShareRootPath Description }}
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
This parameter is reserved for internal Microsoft use.
| Type: | String |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
Applicable: Exchange Server 2016, Exchange Server 2019, Exchange Server SE, Security & Compliance
The WhatIf switch doesn't work in Security & Compliance PowerShell.
The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.
| Type: | SwitchParameter |
| Default value: | None |
| Supports wildcards: | False |
| DontShow: | False |
| Aliases: | wi |
| Position: | Named |
| Mandatory: | False |
| Value from pipeline: | False |
| Value from pipeline by property name: | False |
| Value from remaining arguments: | False |
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
Ask Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign in