Home

Get/Delete email O365 connector

andrew_bryant
Contributor

We have an email security gateway that alerts us when a malicious email was delivered and later determined to be malicious.  The alert contains the internet message ID, and we are ingesting these alerts into Sentinel and creating cases.

 

I'm trying to use the Delete Email option from the Office 365 Outlook connector.  The only input it accepts is "message id" but the internet message ID does not work with this.  In troubleshooting, I used the "when an email arrives" trigger from Office 365 Outlook.  When I use this trigger, the output has a field called "Id." When I use this as dynamic content with delete email, it works.

 

Here is an example of the ID output from the trigger:

"Id": "AAMkAGMxZWU4YjZhLTFlMzYtNGJmNS04Y2FhLWE3NDE3MGU2NjEzNQBGAAAAAABdhymg8kc0QbpvVPA4QyczBwC_VdrZ8-zVQIUQ2GWzX16aAAAAqwVKAADzDKUfXOGWRJjmfj71ih95AAFiix4lAAA="
 
I have a ticket open to see if there is a way to use the internet message ID with this connector, but I was wondering if anyone had run into this issue yet.  The technician is checking with the product group, but recommended using an Azure function app to convert the internet message ID to the message ID recognized by the connector.  However, he wasn't certain what method was being used to compute the new ID value or if it was even based off of the internet message ID.
 
Anyone know how to do this?
 
Thanks,
 
Andrew
1 Reply

@andrew_bryant 

Hey Andrew,

this is more an Office API question as you identified you will need to convert to the message id.  

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies