Forum Discussion

hbarrynz's avatar
hbarrynz
Copper Contributor
May 28, 2024
Solved

Matching Content explorer exports in content search - Exchange

Hi I have been tasked with finding all cardholder data in our tenant. For SPO and onedrive I can search directly from content search (or ediscovery search) This is useful because we can export ite...
Content explorer
exchange
purview
  • BrrGrr's avatar
    BrrGrr
    May 30, 2024

    hbarrynz I've spent the better part of a week looking at this. I found you want to pare the results with MS Graph API.

    In Microsoft Entra, you'll need to setup a new App registration and give it "Application" access to Microsoft Graph, with Mail.ReadWrite and User.Read.All permissions.

    Then setup a secret for the app and use that. With this you can login to msgraph via powershell

     

     

    $clientSecretCredential = Get-Credential -Credential "Application (client) ID"
# Enter client_secret in the password prompt.
Connect-MgGraph -TenantId "Directory (tenant) ID" -ClientSecretCredential $ClientSecretCredential

     

     

    After that you can throw in a foreach loop of your ContentExplorerData and grab any relevant information you want to use . You can preview your information and what it would look like via

     

     

    Get-MgUserMessage -UserId $ContentExplorerData[1].FileSourceUrl -MessageId $ContentExplorerData[1].FileUrl | Select *

     

BrrGrr's avatar
BrrGrr
Copper Contributor
May 30, 2024

hbarrynz I've spent the better part of a week looking at this. I found you want to pare the results with MS Graph API.

In Microsoft Entra, you'll need to setup a new App registration and give it "Application" access to Microsoft Graph, with Mail.ReadWrite and User.Read.All permissions.

Then setup a secret for the app and use that. With this you can login to msgraph via powershell

 

 

$clientSecretCredential = Get-Credential -Credential "Application (client) ID"
# Enter client_secret in the password prompt.
Connect-MgGraph -TenantId "Directory (tenant) ID" -ClientSecretCredential $ClientSecretCredential

 

 

After that you can throw in a foreach loop of your ContentExplorerData and grab any relevant information you want to use . You can preview your information and what it would look like via

 

 

Get-MgUserMessage -UserId $ContentExplorerData[1].FileSourceUrl -MessageId $ContentExplorerData[1].FileUrl | Select *

 

  • hbarrynz's avatar
    hbarrynz
    Copper Contributor
    May 30, 2024

    BrrGrr Thank you!!! This is exactly what I was after, have just tested this & it works nicely

    I can use Get-MgUserMessageContent to export all items for further scannning.

    And Get-MgUserMessage will give me the properties I need to match up in content search for search and purge.

    Thanks again 

Resources