M365 Changelog: Removing Message Trace in SCC. Move Custom Queries to Message Trace in the new Modern EAC.

MC275807 – Attention: Microsoft will be retiring Message Trace in the Security and Compliance Center (SCC) from the Security Portal beginning October 5th, 2021.

  • In place of this feature, Microsoft recommends you use the Message Trace in the Exchange Admin Center (EAC), which is where they will continue to invest our development resources.

How this will affect your organization:

You will not be able to use Message Trace in the Security and Compliance Center after October 5th, 2021. Message Trace has the options to use default queries, custom queries, and autosaved queries.

  • Custom queries in Message Trace in the Security and Compliance Center portal will not be migrated to the new Modern EAC portal. Message Trace custom queries in the Security and Compliance Center are stored differently from custom queries on Message Trace in the new Modern EAC.

Another key difference in Message Trace in the new Modern EAC portal is that your custom queries are stored on a per user basis unlike Message Trace on SCC where custom queries were being stored on a per-tenant basis. Therefore, in the new Modern EAC a user will not be able to see a custom query created by another user. In the SCC, when a user created a custom query, other users were able to see the custom query created due to it being stored at the tenant-level. This is due to privacy and security reasons for EAC.

What you need to do to prepare:

Note: If you have custom queries stored in Message Trace in the Security and Compliance Center that you want to keep, you will need to recreate these queries in Message Trace in the new Modern EAC. If not, they will not be able to be retrieved after Message Trace in the SCC is removed.

For more information, see Message Trace in the new Modern EAC.