OMEPortal

Articolo
07/25/2023

Microsoft Purview Message Encryption is a service that allows organizations to send encrypted mail to any recipients.

OMEPortal is a type of event that is recorded in the Office 365 Unified Audit Log. It represents any activity to access an encrypted message by an external recipient using the encrypted message portal. This event is useful to determine when and who accessed the portal.

authenticate
open message
view attachment
download attachment
reply/forward message

Access the Office 365 Unified Audit Log

The audit logs can be accessed using the following methods.

The audit log search tool in the Microsoft Purview compliance portal.
The Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.
The Office 365 Management Activity API.

Audit log search tool

Go to the Microsoft Purview compliance portal and sign in.
In the left pane of the compliance portal, select Audit.

Note

If you don't see Audit in the left pane, see Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance for information about permissions.
On the New Search tab, set Record type to OMEPortal and configure the other parameters.

For more information on viewing the audit logs in the Microsoft Purview compliance portal, see Audit log activities.

Search Unified Audit Log in PowerShell

To access the Unified Audit Log using PowerShell, first open a PowerShell window and connect to Exchange Online PowerShell. For instructions, see Connect to Exchange Online PowerShell.

Search-UnifiedAuditLog cmdlet

The Search-UnifiedAuditLog cmdlet is a PowerShell command that can be used to search the Office 365 Unified Audit Log. The Unified Audit Log is a record of user and administrator activity in Office 365 that can be used to track events. For best practices on using this cmdlet, see Best Practices for using Search-UnifiedAuditLog.

To extract the OMEPortal events from the Unified Audit Log using PowerShell, you can use the following command. This will search the Unified Audit Log for the specified date range and return any events with the record type "OMEPortal". The results will be exported to a CSV file at the specified path.

Search-UnifiedAuditLog -RecordType OMEPortal -StartDate (Get-Date).AddDays(-100) -EndDate (Get-Date) | Export-Csv -Path <output file>

The following is an example of OMEPortal event from PowerShell, with opening message in the encrypted message portal activity.


RecordType   : OMEPortal 

CreationDate : 3/22/2023 7:00:59 PM 

UserIds      : admin@M365x965352.onmicrosoft.com 

Operations   : MessageAccess 

AuditData    : {"CreationTime":"2023-03-22T19:00:59","Id":"a3500d45-6ab3-4971-a762-a01a846015d0","Operation":"MessageAccess","OrganizationId":"84b06764-3e5e-4f51-9a78-046a7f38b59b","RecordType":154,"ResultStatus":"Success","UserKey":"admin@M365x965352.onmicrosoft.com","UserType":0,"Version":1,"Workload":"Exchange","UserId":"admin@M365x965352.onmicrosoft.com","AuthenticationMethod":"Google","AuthenticationStatus":0,"MessageId":"<MW5PR18MB5094602B59DFEC335A3C5E58AA869@MW5PR18MB5094.namprd18.prod.outlook.com>","OperationProperties":[{"Name":"MailSubject","Value":"Support case 1234567"}],"OperationStatus":0,"Recipient":"samschan.msft@gmail.com","Sender":"admin@M365x965352.onmicrosoft.com"} 

ResultIndex  : 6 

ResultCount  : 7 

Identity     : a3500d45-6ab3-4971-a762-a01a846015d0 

IsValid      : True 

ObjectState  : Unchanged

Use the following command to specifically search for the scenario in which user views an attachment. An example of the result of the PowerShell cmdlet is also shown below.

Search-UnifiedAuditLog -Operations AttachmentReview -RecordType OMEPortal -StartDate (Get-Date).AddDays(-100) -EndDate (Get-Date)

The following is an example of AipSensitivityLabelAction event from PowerShell, with sensitivity label updated.


RecordType   : OMEPortal 

CreationDate : 3/22/2023 7:04:09 PM 

UserIds      : admin@M365x965352.onmicrosoft.com 

Operations   : AttachmentReview 

AuditData    : {"CreationTime":"2023-03-22T19:04:09","Id":"ef29c387-c81b-4812-9020-90b378d92cde","Operation":"AttachmentReview","OrganizationId":"84b06764-3e5e-4f51-9a78-046a7f38b59b","RecordType":154,"ResultStatus":"Failure","UserKey":"admin@M365x965352.onmicrosoft.com","UserType":0,"Version":1,"Workload":"Exchange","UserId":"admin@M365x965352.onmicrosoft.com","AttachmentName":"Form.docx","AuthenticationMethod":"OTP","AuthenticationStatus":0,"MessageId":"<MW5PR18MB5094CD4A4C6D8A5636154FEBAA869@MW5PR18MB5094.namprd18.prod.outlook.com>","OperationProperties":[{"Name":"MailSubject","Value":"Support case 987654"}],"OperationStatus":1,"Recipient":"samschan.msft@gmail.com","Sender":"admin@M365x965352.onmicrosoft.com"} 

ResultIndex  : 4 

ResultCount  : 7 

Identity     : ef29c387-c81b-4812-9020-90b378d92cde 

IsValid      : True 

ObjectState  : Unchanged

The other operations that can be specifically searched for within OMEPortal include AttachmentDownload, AuthenticationRequest, MessageAccess, and MessageForward.

Attributes of the OMEPortal event

The following table contains information related to OMEPortal events.

Event	Type	Description
Activity	String	The activity type for the audit log. For OMEPortal, operations can include: - AttachmentDownload - AttachmentReview - AuthenticateRequest - MessageAccess - MessageForward
AttachmentName	String	Part of AuditData. The name of the attachment in the message.
AuditData	String	The log details on the OMEPortal activity.
AuthenticationMethod	String	Part of AuditData. The type of authentication used to login to portal. Values are: - OTP - Google - Yahoo - Microsoft
AuthenticationStatus	Double	The status of the authentication. 0 = success 1= failure
CreationTime	Date/time	The date and time in Coordinated Universal Time (UTC) when the user performed the activity.
Id	GUID	Unique identifier of an audit record.
MessageId	String	The message ID.
Operation	String	Same value as activity.
OperationProperties	String	Part of AuditData. Contains the email subject.
Recipient	String	Part of AuditData. The email address of user accessing the message in the encrypted message portal.
RecordType	Double	The type of operation indicated by the record. 154 represents an OMEPortal record.
ResultsStatus	String	Operation was either successful or a failure.
Sender	String	Part of AuditData. The email address of user that sent the encrypted message.
Workload	String	Exchange to indicate email in the encrypted message portal.
UserId	String	The User Principal Name (UPN) of the user in your organization who sent the encrypted mail the action that resulted in the record being logged.

Condividi tramite