Office 365 Search for Alias PowerShell

I recently came across a situation where spam was being delivered to an email address of a former employee. I was certain that the previous employee did not have a mailbox, but I wasn’t convinced that the address was not being used as an alias on another account. Since I didn’t remember where I pointed the alias, I had to do some searching.

I connected to Office 365 Exchange via PowerShell and ran the following commands:

$LiveCred = Get-Credentials
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $LiveCred -Authentication Basic -AllowRedirection
Import-PSSession $Session
Get-Mailbox -Identity * | Where-Object {$_.EmailAddresses -like 'smtp:ml*@domain.com'} | Format-List Identity

The Get-Mailbox searched through all of the mailboxes with the wildcard (*). After that, the Where-Object looked for similar results in the EmailAddresses attribute in all the mailboxes. Then I displayed the Identity of the user that has the alias in their account.

Pretty easy and straightforward, but it was a nice way to search through a lot of email addresses without a lot of work. If you want to see the actual email addresses, you can add EmailAddresses at the end of the Format-List.

Get-Mailbox -Identity * | Where-Object {$_.EmailAddresses -like 'smtp:ml*@domain.com'} | Format-List Identity, EmailAddresses

Advertisements

2 thoughts on “Office 365 Search for Alias PowerShell

  1. Attempted to like your post. Need to create WordPress account. I “Like” your post. Wish I could subscribe.

    Helped me out of a jam. (Was really confused as to how an email address kept redirecting to me and sending me spam, turned out I was the owner of said address which was a huge *facepalm* moment.)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s