An API that connects multiple Microsoft services, enabling data access and automation across platforms
customizedReportRecipientEmailAddress always empty on non-microsoft report add-in
When requesting data from https://graph.microsoft.com/beta/security/threatSubmission/emailThreatSubmissionPolicies/, the field
customizedReportRecipientEmailAddress is always empty whenever we define the settings to "Use non-Microsoft Report add-in" which seems like the non-wanted behaviour.
From the documentation on third-party reporting tools (https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/submissions-user-reported-messages-custom-mailbox?view=o365-worldwide#message-submission-format-for-third-party-reporting-tools), it is specified that emails should be sent to the "reporting mailbox" (e.g. what is stored at https://security.microsoft.com/securitysettings/userSubmission). Through this it would make sense that the inbox for reporting emails is exposed through graph-api, for any third-party tool to be able to fetch if they have the necessary permission to read these settings, as the reporting still goes through microsofts user-submission.