Purview just not deleting searched data.

Hi Richard Simmons,
Thankyou for reaching microsoft Q&A!
What you’re seeing is expected behavior for a Compliance Search purge action in Microsoft Purview. When New-ComplianceSearchAction -Purge -PurgeType HardDelete shows Completed, it indicates the purge action has finished processing, but it does not necessarily mean that all matching items are immediately removed from the search results or underlying stores.

This is because the purge operation is intentionally limited and designed for targeted cleanup. Only a small number of items per mailbox are removed in a single run, so when the search returns a large result set, multiple purge iterations are typically required to reduce the overall count.

Additionally, if any items are subject to Litigation Hold, retention policies, or similar compliance settings, they will not be permanently deleted until those protections are removed. In such cases, the purge action can complete successfully while the content remains discoverable.

For larger-scale cleanup scenarios, it’s recommended to run the purge in batches and verify whether any holds or retention policies are in place. Allowing some time for search results to refresh can also help before revalidating the item count. If you’re working with a high volume of data, newer Purview workflows such as Data Security Investigations may provide a more scalable approach.

this behavior does not indicate a failure. The remaining items are typically due to purge limits, policy protections, or the need to process deletion across multiple runs.

Unless your query is scoped to a specific folder, matching items across the entire mailbox will be returned, which also covers items in the RecoverableItems subtree. What the AI failed to point above is that items can end up therein even without the mailbox being on hold, as by default single-item recovery is enabled for mailboxes in ExO, which in turn results in hard-deleted items stored for 14-30 days. If you are aiming to immediately delete items, you should follow the steps in this article to disable any holds, SIR and other features involved in the process.

Or you can just confirm that the items are currently residing within the RecoverableItems subtree, where the user can no longer access them, and wait for the retention period to expire for a proper purge. The eDiscovery item export (without the actual items) will contain the full path to the items, so you can verify their current location.

Purview search-and-purge has several built‑in behaviors and limits that can make it look like items are “not deleted,” especially for large result sets such as big contact lists. The behavior in the screenshot (ComplianceSearchAction shows Completed, but items still appear) is consistent with these limits and with hold/retention behavior, not with a known product bug in the provided context.

Key points and checks:

1. Per‑mailbox purge item limits
   • When using New-ComplianceSearchAction -Purge, only a limited number of items per mailbox are deleted in each run (10 via PowerShell, 100 via Microsoft Graph).
   • For large contact lists spread across mailboxes, many matching items can remain after a purge completes. The documented guidance is to repeat the purge if more than the per‑mailbox limit remains.
   • It is explicitly recommended not to work around this by continually running purge in a tight loop; instead, use other remediation features (for email) such as Zero‑hour auto purge (ZAP) or other remediation tools if the scenario is malicious email.
2. Holds and retention policies prevent permanent deletion
   • If the mailbox is on Litigation Hold, eDiscovery hold, delay hold, or subject to a retention policy, purged items are moved into the Recoverable Items subtree (for example, Deletions or Purges) and preserved until the hold/retention period expires.
   • In that case, items are removed from normal user view but still exist and can appear in compliance searches, which can make it seem like the purge “did not work.”
   • To verify this, export the search results report and check whether the file paths show the items under the Recoverable Items folder. If so, New-ComplianceSearchAction will not delete them further.
   • To check hold status, use Get-Mailbox | fl *Hold*,*Recovery* and Get-OrganizationConfig | fl *Hold*. If holds exist, either use Priority Cleanup or remove/exclude the mailbox from the hold before attempting a true purge.
3. Soft vs hard delete behavior
   • -PurgeType SoftDelete moves items to the Deletions folder in Recoverable Items; they remain recoverable for the deleted item retention period and then move to Purges, and only after that retention period are they permanently removed.
   • -PurgeType HardDelete moves items directly to the Purges folder; they are still retained there for the deleted item retention period if single item recovery is enabled. They are only permanently removed after that period when the Managed Folder assistant processes the mailbox.
   • Therefore, even a successful HardDelete purge will not immediately erase items from the service; they can continue to appear in compliance searches until the retention window passes.
4. Large‑scale scope limits
   • A single search‑and‑purge operation can target at most 50,000 mailbox locations. If more locations are needed, the documented approach is to segment the operation using search permissions filters and run multiple searches.

Practical steps to confirm behavior and move forward:

1. Verify purge actually ran and completed
   • Use Get-ComplianceSearchAction for the …_Purge action (as in the screenshot) and confirm Status = Completed.
2. Check where remaining items reside
   • Export the search report and confirm whether remaining hits are in Recoverable Items. If so, they are on hold/retention and not eligible for further purge via New-ComplianceSearchAction.
3. Check and adjust holds/retention if true deletion is required
   • Use the Exchange PowerShell checks for Litigation Hold, delay hold, and tenant‑level holds.
   • If policy allows, remove or adjust holds or use Priority Cleanup, then rerun purge.
4. For very large per‑mailbox counts
   • Re‑run the purge for the same search if more than the per‑mailbox limit remains, but avoid excessive looping; consider alternative remediation mechanisms if this is about malicious or unwanted messages.

In summary, the behavior is governed by documented limits (per‑mailbox deletion caps, 50,000‑location cap) and by hold/retention semantics, rather than an unspecified Purview defect.

References:

• Find and delete email messages in eDiscovery
• Take mitigation actions in Data Security Investigations