I can't get this to work with a supplied .eml file. I get an error. The .eml file was downloaded from Threat Explorer, and uploaded to Azure Cloud Shell. Then fed into a $data variable using
$data = [System.IO.File]::ReadAllBytes('/home/greg/filename.eml')
Write-Error: Microsoft.Exchange.Data.Common.LocalizedException: The MessageFileData parameter doesn't contain a valid .msg or MIME message. When attempting to process it as a MIME message, the following error was returned: MIME content error:
Compliance is strict and a compliance violation (16) was found. at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object target, String helpUrl) at
Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target) at Microsoft.Exchange.Management.Powershell.Support.TestMessageBase.GenerateMessage() at
Microsoft.Exchange.Management.Powershell.Support.TestMessageBase.InternalValidate() at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__113_1() at
Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)