SOP 017 - How to Purge a Phishing Email from All Mailboxes

How to Purge a Phishing Email from All Mailboxes

Outlines the steps to locate a phishing or otherwise malicious email that has already been delivered to Milrose mailboxes, and to remove that email from every recipient's mailbox in a single tenant-wide action using Threat Explorer in the Microsoft Defender portal.

Milrose IT Infrastructure and Operations staff responding to a reported phishing, spoofing, or malware email that has reached one or more user mailboxes. This procedure removes mail from mailboxes across the tenant and is therefore restricted to staff holding the roles listed under Accounts / Access.

• Soft delete — the message is moved to the Recoverable Items folder. It disappears from the user's view but can still be restored by IT or recovered by the user from Recover Deleted Items.
• Hard delete — the message is purged. It cannot be restored by the user, and recovery by IT is not possible unless the mailbox is on Litigation Hold or covered by a retention policy. Hard delete also removes the associated calendar event when the message is a meeting invite.
• Contains any of — an OR match. Every word entered is matched independently, so a three-word entry returns mail containing any one of those words.

To perform the tasks in this SOP you will need an account holding the Security Administrator or Security Operator role, plus the Search and Purge role under Email & collaboration permissions in the Microsoft Defender portal. Read-only security roles can run the search but cannot submit the remediation.

1. Confirm the Threat Before Searching

1. Obtain the reported message. Ask the reporting user to forward it as an attachment, or open it from the quarantine or the original report.
2. Record the exact subject line, the sender address, and the date and time the message was received.
3. Confirm the message is genuinely malicious before proceeding. A purge cannot be undone and will remove the message from every mailbox it matches.
4. If the message is not clearly malicious, escalate to the IT Manager for a decision before continuing.

2. Build the Search in Threat Explorer

1. Sign in to the Microsoft Defender portal at https://security.microsoft.com.
2. Navigate to Email & collaboration → Explorer, then select the All email tab.
3. Set the search filters as shown below.

Figure 1 — Threat Explorer search filters.

1. Date range — set the window to cover the delivery time recorded in Section 1. Widen it by a few hours on either side; do not widen it by days.
2. Filter field — set to Subject. Change the operator to Equals any of so the whole subject line is matched as one string.
3. Filter value — paste the exact subject line recorded in Section 1, then press Enter.
4. Applied filter — confirm the filter chip below the search bar reflects what you intended, then run the search.

3. Verify the Result Set Before Selecting Anything

Figure 2 — Verifying and selecting the result set.

1. Sender address — confirm every row shows the malicious sender recorded in Section 1. If legitimate senders appear in the list, stop and tighten the search.
2. Check the result count against what you would expect from a single phishing send. A count far larger than the recipient count of one message usually means the filter is matching normal business mail.
3. Scan the Recipient and Subject columns for anything that does not belong. Sort by Sender address to make outliers obvious.
4. If anything in the result set looks wrong, return to Section 2 and refine the filters. Do not proceed on a result set you cannot account for.

4. Select the Messages and Start the Action

1. Select the header checkbox (item 2 in Figure 2) to select all rows, including rows not yet loaded by scrolling. To act on a subset instead, tick the individual rows.
2. Select Take action (item 3 in Figure 2) to open the wizard.

5. Choose the Response Action

Figure 3 — Choosing the response action.

1. Select Soft deleted items for the standard response. This removes the message from the user's view while leaving it recoverable if the search turns out to have been too broad.
2. Select Hard deleted items only where the message is confirmed malicious and a permanent purge has been approved by the IT Manager. Record the approver in the description field in Section 6.
3. Select Next.

6. Name the Remediation

Figure 4 — Naming and describing the remediation.

1. Enter a Description containing the ticket number, the sender address, who reported the message, and — for a hard delete — who approved it.
2. Review the impacted assets listed on this screen, then select Next.

7. Review and Submit

Figure 5 — Final review before submission.

1. Confirm the Query shown is the query you intended to run.
2. Select Export and save the CSV of impacted messages. Attach it to the incident ticket as the record of what was removed.
3. Select Submit to run the remediation.

8. After Submission

1. Open Actions & submissions → Action center → History and confirm the remediation completed. Note any messages reported as not remediated.
2. Re-run the Section 2 search to confirm the messages no longer appear as delivered.
3. Block the sender address or domain in the Tenant Allow/Block List if it is not already blocked.
4. Update the incident ticket with the remediation name, the message count, the exported CSV, and the action taken (soft or hard delete).
5. Notify the reporting user and, where the phish reached a large audience, send a short awareness notice to staff.