# Requires ExchangeOnlineManagement 3.3.0+ (PowerShell 5.1 OK)

Import-Module ExchangeOnlineManagement
#Connect-IPPSSession          # compliance endpoint
Connect-IPPSSession -EnableSearchOnlySession

$SearchName   = '11072025_01'
$GroupMailboxes = @(
    '[email protected]',
    '[email protected]'
)

$KqlQuery = @'
kind:email
AND from:"[email protected]"
'@


#$KqlQuery = @'
#kind:email
#AND received>=2025-09-22T05:00:00Z
#AND received<2025-09-23T05:00:00Z
#AND from:"[email protected]"
#'@

#$KqlQuery = @'
#kind:email AND
#(from:"[email protected]" OR
# from:"[email protected]" OR
# from:"[email protected]" OR
# from:"[email protected]" OR
# from:"[email protected]")
#'@


# Remove existing search if it exists
if (Get-ComplianceSearch -Identity $SearchName -ErrorAction SilentlyContinue) {
    Remove-ComplianceSearch -Identity $SearchName -Confirm:$false
}

# Create search with the correct sources
New-ComplianceSearch `
    -Name              $SearchName `
    -ExchangeLocation  $GroupMailboxes `
    -ContentMatchQuery $KqlQuery

Start-ComplianceSearch -Identity $SearchName
Get-ComplianceSearch -Identity $SearchName

#Remove-ComplianceSearch -Identity 09112025_2 -Confirm:$false