mailAssessmentRequest resource type

Used to create and retrieve a mail threat assessment, derived from threatAssessmentRequest.

When you create a mail threat assessment request, the mail should be received by the user specified in recipientEmail. Delegated Mail permissions (Mail.Read or Mail.Read.Shared) are requried to access the mail received by the user or shared by someone else.


Method Return Type Description
Create threatAssessmentRequest mailAssessmentRequest Create a new mail assessment request by posting a mailAssessmentRequest object.
Get threatAssessmentRequest mailAssessmentRequest Read the properties and relationships of a mailAssessmentRequest object.


Property Type Description
category threatCategory The threat category. Possible values are: spam, phishing, malware.
contentType threatAssessmentContentType The content type of threat assessment. Possible values are: mail, url, file.
createdBy identitySet The threat assessment request creator.
createdDateTime DateTimeOffset The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
destinationRoutingReason mailDestinationRoutingReason The reason for mail routed to its destination. Possible values are: none, mailFlowRule, safeSender, blockedSender, advancedSpamFiltering, domainAllowList, domainBlockList, notInAddressBook, firstTimeSender, autoPurgeToInbox, autoPurgeToJunk, autoPurgeToDeleted, outbound, notJunk, junk.
expectedAssessment threatExpectedAssessment The expected assessment from submitter. Possible values are: block, unblock.
id String The threat assessment request ID is a globally unique identifier (GUID).
messageUri String The resource URI of the mail message for assessment.
recipientEmail String The mail recipient whose policies are used to assess the mail.
requestSource threatAssessmentRequestSource The source of threat assessment request. Possible values are: administrator.
status threatAssessmentStatus The assessment process status. Possible values are: pending, completed.


Relationship Type Description
results threatAssessmentResult collection A collection of threat assessment results. Read-only. By default, a GET /threatAssessmentRequests/{id} does not return this property unless you apply $expand on it.

JSON representation

The following is a JSON representation of the resource.

  "destinationRoutingReason": "String",
  "messageUri": "String",
  "recipientEmail": "String",
  "category": "String",
  "contentType": "String",
  "createdBy": {"@odata.type": "microsoft.graph.identitySet"},
  "createdDateTime": "String (timestamp)",
  "expectedAssessment": "String",
  "id": "String (identifier)",
  "requestSource": "String",
  "status": "String"