'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Identify Recipients in a Microsoft 365 External Email Limit Alert
Question details
A Microsoft 365 administrator needs to find the specific email addresses of recipients after a user triggers an external email limit alert.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Investigating a system alert where a user sent messages to 1,000 external recipients and attempted to send to 393 more.
- Observed behavior
- The administrator received a limit alert but needs to trace the exact external recipient addresses the user emailed or attempted to email.
Ensure you are logged into Microsoft 365 with Exchange Administrator, Security Administrator, or Global Administrator privileges to access message traces and compliance logs.
Use Exchange Online Message Trace
Running a message trace is the most direct method to see all emails sent by a specific user within a recent timeframe.
The Exchange admin center provides a message trace tool that follows email messages as they travel through your Exchange Online organization. You can filter by the specific sender to identify all external recipients.
Log in to the Microsoft 365 admin center, navigate to 'Admin centers', and select 'Exchange'.
In the left navigation pane, go to 'Mail flow' and click on 'Message trace'.
Click 'Start a trace'. In the 'Senders' field, enter the email address of the user who triggered the alert.
Adjust the time range slider to cover the period mentioned in the limit alert (e.g., the last 24 hours or up to 10 days).
Click 'Search'. Once the results load, you can review the list of recipients or export the results to a CSV file for detailed analysis.
Investigate via Microsoft Purview Content Search
If you need deeper context into the mailbox activities or the actual content of the sent messages, use Content Search.
Open a Microsoft 365 Support Request
If traces and logs do not reveal the attempted recipients, Microsoft Support can assist with deeper backend analysis.
Manage Your Business Documents Seamlessly with WPS Office
While Microsoft 365 handles your enterprise email environment, WPS Office offers a lightweight, free alternative for your everyday document creation, spreadsheet analysis, and presentations.
- 1. Download the software: Visit the official WPS Office website and download the free suite for your operating system.
- 2. Install and launch: Run the installer, follow the on-screen instructions, and launch WPS Office.
- 3. Open existing files: Directly open your existing Microsoft Office files without needing to convert their formats.
Frequently Asked Questions
How far back can an Exchange Online message trace search?
Standard message traces in the Exchange admin center can search up to the last 10 days instantly. For emails sent between 11 and 90 days ago, you must run a historical search, which processes in the background.
What triggers the Microsoft 365 external email limit alert?
The alert is triggered when a user sends emails to a high volume of external recipients within a rolling 24-hour period, typically exceeding the outbound spam limits configured in your tenant's security policies.
Who can run a Content Search in Microsoft Purview?
Only administrators assigned the eDiscovery Manager role or those explicitly granted Content Search permissions in the Purview compliance portal can run and export these searches.
Can I see BCC recipients in a message trace?
Yes, as an Exchange Administrator running a message trace on your tenant, the results will display all recipients the message was routed to, including those placed in the BCC field by the sender.
