ACSC Logo
© GEMXIT
GEMXIT Logo
Email Security • ZAP • Microsoft Defender XDR

The User Reported The Email - But It Was Already Gone

The user did the right thing.

They reported a suspicious email to IT.

But when the security team opened the mailbox, the message was no longer there. Agent Foskett wanted to know whether the email had been deleted, quarantined, moved or silently remediated by Microsoft 365.

Discuss your email security Back to briefings
Agent Foskett Microsoft Defender XDR email remediation investigation
Briefing summary

A suspicious email was reported, but by the time IT searched the inbox, the message had disappeared. The investigation focused on Defender XDR telemetry, delivery location, post-delivery actions and whether Microsoft had already remediated the message.

User Reported Message = Yes
Mailbox Search = Not Found
DeliveryAction = Investigate
Final Answer = Telemetry

The report came in late

The user did exactly what security awareness training asks them to do. They reported the suspicious email instead of clicking it.
The user noticed something wrong The email had suspicious wording, an unexpected request or a sender the user did not fully trust. They reported it rather than engaging with it.
IT searched the mailbox The security team looked for the message in the Inbox, Junk Email and Deleted Items. The message was not where anyone expected it to be.
The email had already gone The absence of the message did not mean the report was wrong. It meant the investigation needed to move from mailbox search to telemetry.

The first investigation question

Agent Foskett did not ask whether the user imagined the email. He asked what Microsoft 365 did with it.
Was it delivered? EmailEvents can show whether the message entered the tenant, who received it and whether the original delivery decision allowed it through.
Where was it placed? DeliveryLocation explains whether the message went to the Inbox, Junk Email, Quarantine, Deleted Items or another location.
Was it remediated later? Post-delivery remediation can remove, quarantine or move a message after initial delivery, which explains why it can disappear before IT finds it.

The KQL investigation

Agent Foskett starts by finding the reported email in Defender XDR telemetry.
reported-email-search.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
EmailEvents
| where Timestamp > ago(30d)
| where RecipientEmailAddress == "user@contoso.com"
| where Subject contains "invoice"
    or Subject contains "payment"
| project
    Timestamp,
    SenderFromAddress,
    RecipientEmailAddress,
    Subject,
    ThreatTypes,
    DeliveryAction,
    DeliveryLocation

What the logs can explain

A missing message does not mean missing evidence.
Delivered first The email may have been delivered initially, then later removed after threat intelligence, policy action or post-delivery remediation caught up.
Quarantined later A message may disappear from the user mailbox because it was moved to quarantine after Microsoft reclassified the threat.
Removed before review Security teams sometimes arrive after the automated clean-up. The investigation must then prove what happened from logs, not mailbox contents.

Was it a wider campaign?

If one user reported it, other users may have received it without reporting it.
reported-email-campaign-scope.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
EmailEvents
| where Timestamp > ago(30d)
| where Subject contains "invoice"
    or Subject contains "payment"
| summarize
    TotalMessages = count(),
    Recipients = dcount(RecipientEmailAddress),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by SenderFromAddress, SenderIPv4

Checking user impact

An email being gone does not automatically mean nobody interacted with it.
Was it opened? Opening a message is not always compromise, but it helps build the timeline and determine exposure before remediation occurred.
Was a link clicked? If the email included URLs, UrlClickEvents can show whether anyone clicked before the message was removed.
Was anything downloaded? If an attachment or link led to a file, endpoint and browser telemetry may reveal whether the attack moved beyond email.

URL click investigation

The message may be gone, but click telemetry can remain.
url-click-review-after-remediation.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
UrlClickEvents
| where Timestamp > ago(7d)
| where AccountUpn == "user@contoso.com"
| project
    Timestamp,
    AccountUpn,
    Url,
    ActionType,
    Workload

Why the message disappeared

There are several legitimate reasons a reported email may no longer be visible in the mailbox.
Zero-hour auto purge Microsoft 365 may remove malicious or suspicious messages after delivery when later intelligence changes the verdict.
User or rule action The user may have deleted it, an inbox rule may have moved it, or mailbox processing may have placed it somewhere unexpected.
Security action A policy, quarantine action, automated investigation or manual remediation may have removed the email before the analyst searched for it.

Agent Foskett moment

The important clue was not the email sitting in the inbox. It was the evidence that explained why it was no longer there.
The user was right The user really did receive something suspicious. The fact it later disappeared did not invalidate the report.
The mailbox was incomplete A mailbox search only shows what is currently visible. It does not always explain what happened earlier.
The telemetry told the story Defender XDR evidence can show delivery, placement, threat verdicts and remediation even when the original email is gone.

Questions every analyst should ask

When a reported email disappears, the investigation should move from searching the mailbox to reconstructing the timeline.
When was it first seen? Establish the delivery time, sender, recipient, subject and original location before investigating what changed.
Where did it go? Check DeliveryLocation, quarantine evidence, remediation actions, inbox rules and user actions.
Did anyone interact? Confirm whether the user clicked, opened, downloaded, replied or triggered follow-up activity before the message disappeared.

Related investigations

The Email Was Delivered — But Nobody Ever Saw It Learn why delivered does not always mean the message landed in the user's inbox. Read more →
The User Clicked The Link Three Days Later Explore delayed user interaction and why email investigations may need to continue after delivery. Read more →
The Link Was Clicked After The Email Was Delivered Investigate how link clicks can occur after a message has passed initial filtering. Read more →
UrlClickEvents Use Defender XDR URL click telemetry to investigate user interaction with suspicious links. Read more →
Investigating EmailAuthenticationResults in Microsoft Defender XDR Understand how authentication evidence helps explain whether a message deserved trust. Read more →
The Recipient Was Unrecognised See how a Microsoft 365 bounce message exposed a suspicious payment receipt scam. Read more →
The message was gone.
But the evidence remained. That is why defenders investigate the timeline, not just the mailbox.
Contact GEMXIT

Final thought

Security teams should never dismiss a user report just because the email is no longer visible.
At GEMXIT We help organisations investigate Microsoft Defender XDR, email security, phishing, spoofing, Microsoft 365 security and practical threat hunting. If you want to understand how this applies to your environment, see our Microsoft Security services.
Agent Foskett mindset Do not stop because the message is missing. Ask when it arrived, where it went, why it moved and whether anyone interacted with it first.

The user reported the email. The mailbox no longer showed it. The logs explained why. Explore related investigations including DeliveryLocation investigations, UrlClickEvents, and post-delivery click analysis.

Develop IT. Protect IT. GEMXIT PTY LTD | GEMXIT UK LTD
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The User Reported The Email But It Was Already Gone

This Agent Foskett investigation explains how security teams can investigate a user-reported suspicious email that has disappeared from the mailbox before IT can inspect it.

Microsoft Defender XDR Email Remediation Investigation

Microsoft Defender XDR, EmailEvents, DeliveryAction, DeliveryLocation, ThreatTypes and UrlClickEvents can help analysts reconstruct what happened to a suspicious email after delivery, including quarantine, deletion, movement and user interaction.

Zero-Hour Auto Purge And Missing Email Investigations

Post-delivery remediation, including zero-hour auto purge and security policy actions, can remove messages after initial delivery. Analysts should use telemetry to determine whether the email was delivered, moved, quarantined, removed or clicked.