How to get recipient information from Audit.Exchange content type using O365 Management Activity API

Question

How to get recipient information from Audit.Exchange content type using O365 Management Activity API

Steff 20

I'm using a webhook to get audit logs for the Audit.Exchange content type. Regarding 'Send' operations, I can only see the user which sent the email, and the email subject. I'd like to be able to have a list of recipients the email was sent to as well - is this possible using any of the APIs? (Without needing full Mail.Read permissions?)

Venkat Reddy Navari 3,470 Reputation points Microsoft External Staff Moderator

2025-06-12T09:56:59.6066667+00:00

@Steff Just checking in to see if the below answer provided by @Ki-lianK-7341 helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Venkat Reddy Navari 3,470 Reputation points Microsoft External Staff Moderator

2025-06-12T09:56:59.6066667+00:00

@Steff Just checking in to see if the below answer provided by @Ki-lianK-7341 helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Ki-lianK-7341 1,010

Need	Recommendation
See email recipients	Use Get-MessageTrace via Exchange Online
See email recipients	Use `Get-MessageTrace` via Exchange Online
Keep webhook-based audit model	Accept that recipient info won't be reliable
Avoid `Mail.Read`, but need mail metadata	Consider using message trace + audit logs in combination

Steff 20 Reputation points

2025-06-12T09:53:52.4966667+00:00

Thanks for the answer! The cmdlets unfortunately are not an option for us.

Looking into your last option "Consider using message trace + audit logs in combination"

Could I use this api to access message traces?
https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace

I'm able to generate a token (https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token?client_id=abc&client_secret=123&grant_type=client_credentials&scope=https://outlook.office365.com/.default), but the token I receive gives me a 401 on the reports API above. When I decode the token, the token audience is still the graph API. Any ideas?

Thanks!
Venkat Reddy Navari 3,470 Reputation points Microsoft External Staff Moderator

2025-06-13T16:55:33.5666667+00:00

@Steff Since PowerShell cmdlets aren’t an option for you and you're also trying to stay away from Mail.Read, the best workaround is to combine audit logs with message trace data to get a more complete picture.

About the reporting.svc/MessageTrace API you’re not doing anything wrong. That endpoint is actually deprecated, and it doesn’t work with modern Azure AD tokens, which is why you’re seeing the 401 when using a Graph-scoped token.

A more supported route would be using the Get-MessageTrace cmdlet via Exchange Online PowerShell with app-only authentication. This avoids any need for interactive login or full mailbox access. You’ll just need to register an app and assign it the Exchange.ManageAsApp permission.

That setup will allow you to pull details like sender, recipients, timestamps, and message IDs all without requiring Mail.Read.

If you're looking for an API-based approach instead, the Microsoft 365 Defender APIs can provide some useful email metadata, though they might not give full recipient-level detail in all cases.

You can find step-by-step setup instructions here: Use app-only auth in EXO PowerShell

Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Venkat Reddy Navari 3,470 Reputation points Microsoft External Staff Moderator

2025-06-16T09:33:25.9733333+00:00

@Steff Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Steff 20 Reputation points

2025-06-17T14:44:53.73+00:00
Thanks for the update. I'm looking for an API based approach as you said.

Looking into the Defender APIs, I've found this documentation which should in theory allow me to query email events.

However the docs I've linked point out: "Try our new APIs using MS Graph security API", so will this defender API be deprecated as well?

I queried the Graph security API mentioned above, but running a query on EmailEvents hits me with another permission request:

Missing application roles. API required roles: ThreatHunting.Read.All, application roles: Mail.ReadWrite,Directory.Read.All,User.Read.All.
Venkat Reddy Navari 3,470 Reputation points Microsoft External Staff Moderator

2025-06-18T09:21:59.8233333+00:00
@Steff

“Will the Defender API be deprecated as the docs say, 'try our new APIs using MS Graph security API'?”

Yes, Microsoft is consolidating security-related APIs (including Defender for Office 365 telemetry) under the Microsoft Graph Security API. While the older Defender APIs (like reporting.svc) aren’t immediately deprecated, they’re no longer recommended for new integrations. Shifting to Graph is the right move for long-term support.

About the permission error:

“I get a 401 and see permissions like Mail.ReadWrite being required — but I want to avoid that.”

This is expected. To query EmailEvents via Graph Security API, your app must be granted the following application permissions:

ThreatHunting.Read.All – Required for any Defender-related queries

Mail.ReadWrite – Required only if your query includes message body or mailbox-sensitive fields

If you're only querying metadata (like sender, recipients, timestamps), you might get by with just ThreatHunting.Read.All, depending on the exact query.

However, in many tenant configurations, Graph still expects Mail.ReadWrite even when accessing email metadata unfortunately, there's currently no finer-grained permission available. This is a known limitation.

Option 1 – Graph Security API with minimal permissions

Try limiting your query to fields like internetMessageId, senderFromAddress, recipientEmailAddress, and avoid message content.

Assign ThreatHunting.Read.All only.

If it still throws the permission error, it means Mail.ReadWrite is enforced even for metadata in your tenant.

Option 2 – Accept Mail.ReadWrite but limit actual usage

You can grant Mail.ReadWrite to the app but only use it for metadata access, not to read user content. This still avoids full Mail.Read per user scope, and complies better than user-delegated tokens.

Option 3 – Use Exchange Online PowerShell (app-only auth)

If APIs prove too limited, using Get-MessageTrace via PowerShell with Exchange.ManageAsApp permission is still the most stable option to get recipient details without Mail.Read.

It’s scriptable and doesn’t require user context or full mailbox access.

References link: Microsoft Graph Security API Overview: https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview?view=graph-rest-1.0

Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

How to get recipient information from Audit.Exchange content type using O365 Management Activity API

1 answer

Your answer