Function to find the folderID for a Security & Compliance Content Search or eDiscovery Search

Function to find the folderID for a Security & Compliance Content Search or eDiscovery Search

5 / 5 ( 1 vote )

Sometimes, you just get too much stuff, and you need to filter it.

It’s true in life, with YouTube cat videos, and with M365 Content Search.

In this post, we’ll talk about using the FolderId parameter to include/exclude mailbox folders in a content search.  Here we go!


Well, the easy background is that every folder in a mailbox has a unique identification string, known as FolderId.  You can see a certain format of it when you run a Get-MailboxFolderStatistics against a mailbox:

Cool, cool.  Now, you may need to perform a content search or discovery in a user’s mailbox.  Maybe the user has hundreds or thousands of folders and hundreds of thousands of messages and maybe you want to restrict the content search to just messages in a particular folder or subfolder.

The good news is: you can certainly do this.  The bad news has two parts: you can’t get the information you need from anywhere in the user interface, and the FolderId value you see listed in Get-MailboxStatistics isn’t the value you need.

This is certainly a pickle.

Retrieving the correct FolderId value

Fortunately, there’s a way you can retrieve the actual value you need.  It’s with this function.  I’ve repurposed some scripting from the Docs site, swirled it around with some unicorn dust, and put it into a function you can use against a bunch of users or folders.

Getting the function

Easy–just copy/paste this into your PowerShell $PROFILE to have it available every time you connect to Office 365 via PowerShell. Or, just keep it hanging around and dot source it when you need to.

Function Get-FolderID([array]$Mailbox, [array]$FolderPath)
  [System.Collections.ArrayList]$FolderIDValues = @()
  Foreach ($Identity in $Mailbox)
    try { [array]$Folders = Get-MailboxFolderStatistics -Identity $Identity -ea stop }
    catch { "Mailbox $($Identity) not found. Skipping."; Continue }
    foreach ($Folder in $FolderPath)
      $MailboxIdentity = $Identity.ToString()
      $OriginalFolderId = ($Folders | ? { $_.FolderPath -imatch "$Folder`$" }).FolderId
      If ($OriginalFolderId)
        $FolderName = $Folder.ToString()

        # Convert to correct folder encoding
        $Encoding = [System.Text.Encoding]::GetEncoding("us-ascii");
        $FolderIdBytes = [Convert]::FromBase64String($OriginalFolderID);
        $Nibbler = $encoding.GetBytes("0123456789ABCDEF");
        $IndexIdBytes = New-Object byte[] 48;
        $IndexIdIdx = 0;
        $FolderIdBytes | select -skip 23 -First 24 | %{ $IndexIdBytes[$IndexIdIdx++] = $Nibbler[$_ -shr 4]; $IndexIdBytes[$IndexIdIdx++] = $Nibbler[$_ -band 0xF] }
        $FolderId = $($encoding.GetString($indexIdBytes))
      Else { $FolderId = "Folder path/id not found in mailbox"; $FolderName = $Folder }
      # Create the entry object to add to the collection of folders
      $entry = New-Object PSObject
      $entry | Add-Member -Name "Mailbox" -MemberType NoteProperty -Value $MailboxIdentity
      $entry | Add-Member -Name "FolderName" -MemberType NoteProperty -Value $FolderName
      $entry | Add-Member -Name "FolderPath" -MemberType NoteProperty -Value ($Folders | ? { $_.FolderPath -imatch "$Folder`$"}).FolderPath
      $entry | Add-Member -Name "FolderId" -MemberType NoteProperty -Value $FolderId
      $FolderIDValues += $entry
  Return $FolderIDValues

So, now that you have it, how do you use it?

Let’s go!

Using the function

It’s as easy as you hope/think it is.  And I hope it’s as flexible as you need it to be.

Here’s the syntax and some examples to get you started.

Single mailbox, single folder

Use this syntax:

Get-FolderId -Mailbox <mailbox> -FolderPath <Folderpath>

You’ll get the single mailbox returned with the folder name and the Folder ID value that you can use in content search.

Multiple mailboxes, multiple folders

With this example, I introduce multiple mailboxes (one of which does not exist).  You can use this syntax:

Get-FolderId -Mailbox <mailbox1>,<mailbox2>,<mailbox3> -FolderPath <FolderPath1>,<FolderPath2>

Be sure to enclose folder paths with spaces inside of quotes, as you see blow.

Multiple mailboxes, multiple folders or subfolders

To look for subfolders, either specify the leaf (final) subfolder name OR specify the entire path of the folder.  You can specify (or not) the leading forward slash.

Get-FolderId -Mailbox <mailbox1>,<mailbox2> -FolderPath <FolderPath1>,<SubfolderPath1>

Hopefully, that’s enough to get you started!






Published by Aaron Guilmette

Helping companies conquer inferior technology since 1997. I spend my time developing and implementing technology solutions so people can spend less time with technology. Specialties: Active Directory and Exchange consulting and deployment, Virtualization, Disaster Recovery, Office 365, datacenter migration/consolidation, cheese. View all posts by Aaron Guilmette

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Exit mobile version