Context
A sender saying that email was sent and a recipient saying it never arrived can both describe their experience accurately. Investigate a single message path with enough evidence to distinguish submission, transport and mailbox presentation. Repeatedly sending the same message without tracing it can make the incident harder to interpret.
Collect the minimum useful message details
Record the sender, intended recipient, approximate sending time with timezone and the message identifier where available. Ask whether the problem affects every recipient or only one destination. Preserve a non-sensitive subject reference when needed for identification. Check that the user selected the expected sending account and address. Keep diagnostic evidence restricted to authorized support staff rather than forwarding private messages widely just to establish that someone clicked Send.
Search the appropriate trace window
Use Exchange Online's current message-trace capabilities and review the permissions, search scope and available retention for the task. Match the actual time range and recipient rather than relying on a broad default query. Record which result corresponds to the complaint and inspect the relevant events. Microsoft's documentation describes trace behavior and limitations; confirm them before interpreting an absent result as proof that a message never existed. A trace query is an investigative tool, not an independent copy of the sender's entire mailbox.
Interpret the delivery boundary carefully
Determine whether the evidence shows rejection, delay, transfer or delivery within the system's scope. If the next boundary is an external provider, identify what additional evidence that provider or recipient can supply. Inbox visibility can also be affected by mailbox rules, junk handling or client behavior. Do not equate one transport status with a guarantee that a person read the message. Check any non-delivery report for a useful failure reason before proposing changes to authentication or filtering.
Resolve and document the actual cause
Choose a correction supported by the traced events, such as addressing a routing issue or helping the recipient inspect an authorized mailbox location. Send a controlled follow-up test and compare it with the original path. Record the finding in plain language for the business user and keep sensitive message details out of the general ticket summary. Escalate with the specific identifiers and timestamps needed by the next support team, avoiding a vague request to fix all email delivery.
Discuss the environment, constraints and acceptance criteria with Clouvenix microsoft 365 specialists before scheduling production changes.
Technical reference
Official platform documentation. Confirm options, support status and operational behavior for the installed release. The workflow above is an engineering review approach, not a universal configuration recipe.