'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Purview Content Search Returning Identical Received and Sent Email Counts
Question details
User is experiencing identical return counts for sent and received messages when performing a Purview Content Search.
- Product
- Microsoft Purview
- Device & OS
- not provided
- Scenario
- Running a content search in Microsoft Purview for Exchange Online emails.
- Observed behavior
- The search returns the exact same number of results for both received and sent email queries, indicating a potential issue with query syntax, filters, or deduplication settings.
Ensure you have the necessary eDiscovery or Compliance Administrator permissions in Microsoft Purview to create, edit, and review content searches.
Verify KQL Syntax and Deduplication Settings in Purview
Check your Keyword Query Language (KQL) syntax and ensure deduplication settings are not artificially merging results to make sent and received counts identical.
Identical search result counts for sent and received emails are often caused by overly broad KQL queries or enabled deduplication features. When deduplication is active, Purview merges duplicate copies of emails (e.g., an email in the sender's Sent Items and the recipient's Inbox), which can equalize the count.
Log in to the Microsoft Purview compliance portal and navigate to the Content Search section.
Open your search and review the query. Ensure the conditions for the 'received' and 'sent' date fields are correctly distinguished and not overlapping.
Look at your search export or display settings to see if deduplication is enabled. If it is, temporarily disable it to see if the raw counts for sent and received emails differ.
Verify that your date range and subject condition filters are applied specifically to the inbound or outbound query as intended.
Re-run the content search with the updated filters and disabled deduplication to confirm whether the result counts now accurately reflect the separate received and sent metrics.
Looking for a Lightweight Microsoft Office Alternative?
While Microsoft Purview handles complex enterprise compliance for Exchange, everyday document, spreadsheet, and presentation tasks can be easily managed with WPS Office. It is a free, highly compatible alternative to Microsoft Office that is perfect for users wanting a faster, simpler experience without a heavy subscription.
- 1. Download WPS Office: Visit the official WPS Office website to download the free installation package for your operating system.
- 2. Install and Set as Default: Run the installer and follow the prompts. During setup, you can choose to set WPS Office as the default app for standard Office formats.
- 3. Open Your Documents: Double-click any existing .docx, .xlsx, or .pptx file to open it instantly in WPS Office without losing formatting.
Frequently Asked Questions
Why does deduplication cause identical email counts in Purview?
When deduplication is enabled, Purview removes duplicate copies of the same message found across different mailboxes. If a message was sent and received within the searched scope, the deduplication process consolidates them into one item, which can result in identical counts for the overall sent and received search results.
What is KQL in Microsoft Purview Content Search?
Keyword Query Language (KQL) is the advanced query syntax used in Microsoft Purview to search for specific terms, metadata, and conditions across Exchange Online, SharePoint, and other Microsoft 365 services.
How do I correctly format date ranges in a Purview KQL search?
You should use the standard KQL date format (e.g., received:01/01/2023..12/31/2023). Make sure you specify either the 'sent:' or 'received:' property clearly depending on whether you are querying outbound or inbound communications to avoid mixing the results.
