More than often we try to play with some transport rule and when we don’t get the intended results we try to see what’s going on. The main thing that we want to understand here is whether the rule that we created is being applied to messages or not.

We will also sometimes end up in a scenario where some action has been taken on an email and we have a zillion transport rules and having a tough time figuring out which rule got applied to the email in question

There could be many ways of doing this. Here I will be explaining a simple way to find the same

  1. Run an Extended message trace and download the CSV.
  1. Now that you have the fine, connect to Exchange Online Powershell and run the below command
    Get-TransportRule | FL Identity, Guid
    Example below :-
    Get-TransportRule | fl *Identity*, Guid
    Identity : matches these text patterns in the subject: ‘^$’
    Guid     : 6b3562db-03ee-44b3-b3e7-daabcdea232
  1. Now open the message that you are trying to analyze and note down the message ID from the Header of the message. Now filter out the downloaded CSV with the MessageID you got from the previous step(column header name message_id)
messageid
Message ID field in CSV


Note:  If you know the specific Sender, then you can directly filter the CSV according to the details.

 

  1. Once filtered now search for “ruleId” in the CSV. You will find it in the column header named custom_data
  2. If the ruleId in the CSV match the Guid you got in step 1, then this mail was processed by the concerned rule.

Note: If the rule does not match the Guid, you can run the command in step 1 again and see the rule which matches the ruleId

–   Praveen Kumar E     

www.Modern365.co.in