I've been struggling with an issue for a few days now regarding my PowerShell script that automates email purging. While I can create a New-ComplianceSearch without any problems, attempting to preview it with New-ComplianceSearchAction results in a "403 Forbidden" error. I can replicate this outside of my script by running `New-ComplianceSearchAction -SearchName $SomeSearch -Preview` on an already existing search, and it still gives me the same error. We've been running this script successfully for a while, and the only significant change I made recently was adding the -EnableSearchOnlySession flag to Connect-IPPSSession due to some permission updates from Microsoft last year. Is anyone aware of any recent role or permission changes, especially regarding GCC, that might be causing this?
Edit 3/4/2026: It appears Microsoft may have removed the -preview functionality for Exchange Online, which results in the 403 error. We might need to rely on the portal GUI for samples to validate emails before purging, which is a bummer due to the speed and scale of the process.
3 Answers
thanks though OP 🙂
FFSSSSSSSSSSSSSS why Microsoft do you do this 🙁
I feel you, GCC seems like a mystery sometimes! Are you sure you have the right PIM role activated for compliance search? That might be the key here. Double-check your permissions just in case!
I found a mention on Microsoft Docs that says the -Preview parameter only works in on-premises Exchange. It seems they've made some changes recently, which explains this issue. You might want to check their updates for May 2025!