Powershell - Office 365 security and compliance

Question

I am trying to get this PowerShell script to auto generate the key parts of the command to run with minimal interaction.

Script as follows:

$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session

#Create Search with parameters
$SearchName = Read-Host "Enter Search name"
$date = Get-Date -format "MM/dd/yyyy"
$Subject = Read-Host "Enter Subject"
New-ComplianceSearch -Name "$SearchName" -ExchangeLocation all -ContentMatchQuery "'sent>=$date AND sent<=$date AND subject:"$Subject"'"

Error...

New-ComplianceSearch -Name "$SearchName" -ExchangeLocation all -ContentMatchQuery "'sent>=$date AND sent<=$date AND subject:"$Subject"'" A positional parameter cannot be found that accepts argument 't''. + CategoryInfo : InvalidArgument: (:) [New-ComplianceSearch], ParameterBindingException + FullyQualifiedErrorId : PositionalParameterNotFound,New-ComplianceSearch + PSComputerName : nam01b.ps.compliance.protection.outlook.com

I think the issue is going to be with your quoting. Please try "sent>='$date' AND sent<='$date' AND subject:'$Subject'" as your content query. It is possible that you need to single quote the values of the fields only. I know that KQL queries expect values with spaces to be surrounded by quotes. If you want variables to evaluate, you need outside double quotes. — AdminOfThings

Greg Blair Greg Blair · Accepted Answer · 2019-10-01T22:00:47

you need to add the Powershell gravemarker ` in order to not have your double quotes break the string

this should work:

New-ComplianceSearch -Name "$SearchName" -ExchangeLocation all -ContentMatchQuery "'sent>=$date AND sent<=$date AND subject:`"$Subject`"'"

Powershell - Office 365 security and compliance

1 Answers