EWS Extension Online Powershell v3

Use the EWS Extension Online Powershell v3 integration to get information about mailboxes and users in your organization. This integration can also retrieve and modify Tenant Allow/Block Lists.

Email · Microsoft Exchange Online

Details

IDEWS Extension Online Powershell v3
ProviderMicrosoft
CategoryEmail
From Version5.5.0
Docker Imagedemisto/pwsh-exchangev3:1.0.0.11550820
Supported ModulesAgentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Use the EWS Extension Online Powershell v3 integration to get information about mailboxes and users in your organization.
This integration was integrated and tested with version v3 of EWS Extension Online Powershell v3

Note: This integration does not replace the O365 - EWS - Extension integration, but an additional EWS extension integration
which utilizes the EXO v3 module.

Configure EWS Extension Online Powershell v3 in Cortex

Parameter Description Required
Name The name of the integration True
Exchange Online URL https://outlook.office365.com True
Certificate A txt certificate encoded in Base64. True
The organization used in app-only authentication.   True
The application ID from the Azure portal   True

App authentication

To use this integration, you need to connect an application with a certificate.

  1. Create the application:
    1. Access Azure AD portal.
    2. Navigate to Home > App registrations.
    3. Click New Registration, give the application a name (for example: EWS) and click Register.
    4. In the left menu of the newly created application, click API permissions.
    5. Click Add a permission.
    6. In the Request API permissions page, click APIs my organization uses.
    7. Search for Office 365 Exchange Online.
    8. Click Application permissions.
    9. Under Exchange, click the ExchangeManageAsApp checkbox.
    10. Click Add permissions.
    11. Click Grant admin consent.
  2. Create the certificate in Cortex XSOAR/XSIAM.

    1. Run the CreateCertificate command in the Playground to acquire the certificate.

      !CreateCertificate days=<# of days> password=password

    Note: Remember your password since you will need it to create your integration instance.

    1. Download the certificateBase34.txt file.
    2. Open the downloaded txt file and copy the text.
    3. In the integration instance configuration, paste the text in the Certificate field.
  3. Attach the .cer file to your Azure app.
    1. In the Cortex XSOAR/XSIAM Playground, download the publickey.cer file
    2. In the Azure application, in the left menu, click Certificates & secrets.
    3. In the Certificates tab, upload the publickey.cer file.
  4. Assign Azure AD roles to the application.
    1. You have two options:
      • Assign Azure AD roles to the application.
      • Assign custom role groups to the application using service principals.
    2. In the Azure AD portal, search for Microsoft Entra roles and administrators in the Search box.
    3. On the Roles and administrators page that opens, find and select one of the supported roles by clicking on the
      name of the role (not the checkbox) in the results.
      • The role Security Administrator is eligible for this integration.
    4. On the Assignments page that opens, select Add assignments.
    5. In the Add assignments flyout that opens, find and select the app that you created in Step 1.

Note: The information in the Playground is sensitive information. You should delete the information by running the following command:

!DeleteContext all=yes

  1. In Cortex XSOAR/XSIAM, in the integration instance configuration, enter your saved password in the Password field.
  2. In Azure, go to Entra ID (Overview blade) and copy the Primary domain field.
  3. In Cortex XSOAR/XSIAM, in the integration instance configuration, paste the Domain name in The organization used in app-only authentication field.
  4. In the Azure app, navigate to Home > App registration > application name and copy the Application (client) ID.
  5. In Cortex XSOAR/XSIAM, in the integration instance configuration, paste the application ID in The application ID from the Azure portal field.

Verify that the admin account has sufficient Exchange Online permissions

For the integration to work, the Azure AD application’s service principal must have the correct permissions assigned in the Exchange Online role groups.

  1. Open the Microsoft Purview Portal: https://purview.microsoft.com/
  2. Log in using an admin account that can manage role assignments for the Azure AD application (for example, a Global Administrator or Privileged Role Administrator).
  3. In the top bar, select: Settings → Roles and scopes
  4. In the left sidebar, select: Role Groups
  5. Search for the following role groups:
    • Organization Management – the most privileged role and fully supported for this integration.
    • Security Administrator – a highly privileged security role that also provides full access.
  6. Open the role and verify that the service principal of the Azure AD application used by the integration is listed.
  7. If not listed, click Edit → Add Users and assign the required roles.

Troubleshooting and Testing

Common Issues and Solutions

The role assigned to application 'app-id' isn't supported in this scenario.

Scenario:
When running ‘Test’, you receive the error:
“The role assigned to application app-id isn’t supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.”

Solution:
Verify that the application has the correct directory role assigned in the Entra ID portal.
See the “App authentication” section above for detailed guidance.

The term 'cmdlet' is not recognized as a name of a cmdlet…

Scenario:
When running a command, you receive an error similar to:
“The term cmdlet is not recognized as a name of a cmdlet, function, script file, or executable program…”

Solution:
Make sure the service principal of the Azure AD application used by the integration has sufficient Exchange Online permissions.
Refer to the “Exchange Online permissions” section above to confirm the correct roles are assigned and detailed guidance.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ews-mailbox-list

Displays mailbox objects and attributes, populate property pages, or supplies mailbox information to other tasks.

Base Command

ews-mailbox-list

Input

Argument Name Description Required
identity The identity of the mailbox you want to view. Optional
organizational_unit The object’s location in Active Directory by which to filter the results. Optional
primary_smtp_address The primary SMTP email address of the mailbox you want to view. Cannot be used with the user_principal_name argument. Can be retrieved using the ews-user-list command. Optional
user_principal_name The UPN of the mailbox you want to view. Cannot be used with the primary_smtp_address argument. Can be retrieved using the ews-user-list command. Optional
property_sets A comma-separated list of property sets to fetch. These property sets will supplement the outputs of this integration. Default is “Minimum”. Available properties are: “All”, “Minimum”, “AddressList”, “Archive”, “Audit”, “Delivery”, “Hold”, “Moderation”, “Move”, “Policy”, “PublicFolder”, “Quota”, “Resource”, “Retention”, “SCL”, “SoftDelete”, “StatisticsSeed”. Optional
limit The maximum number of results to retrieve. Default is 10. Default is 10. Optional

Context Output

Path Type Description
EWS.Mailbox.EmailAddresses String Email addresses of the mailbox.
EWS.Mailbox.AuditBypassEnabled Boolean Whether audit bypass is enabled.
EWS.Mailbox.DistinguishedName String Distinguished name of the mailbox.
EWS.Mailbox.ExchangeObjectId String Exchange object ID of the mailbox.
EWS.Mailbox.ExchangeVersion String Exchange version of the mailbox.
EWS.Mailbox.Guid String GUID of the mailbox.
EWS.Mailbox.Id String ID of the mailbox.
EWS.Mailbox.Identity String Identity of the mailbox.
EWS.Mailbox.IsValid Boolean Whether the mailbox is valid.
EWS.Mailbox.Name String Name of the mailbox.
EWS.Mailbox.ObjectCategory String Object category of the mailbox.
EWS.Mailbox.ObjectClass String Object class of the mailbox.
EWS.Mailbox.ObjectId String Object ID of the of the mailbox.
EWS.Mailbox.ObjectState String Object state of the mailbox.
EWS.Mailbox.OrganizationId String Organization ID of the mailbox.
EWS.Mailbox.OriginatingServer String Originating server of the mailbox.
EWS.Mailbox.PSComputerName String PowerShell computer name of the mailbox.
EWS.Mailbox.PSShowComputerName Boolean PowerShell show computer name of the mailbox.
EWS.Mailbox.RunspaceId String Run space ID of the mailbox.
EWS.Mailbox.WhenChanged Date Local time of when the mailbox was last changed.
EWS.Mailbox.WhenChangedUTC Date UTC time of when the mailbox was last changed.
EWS.Mailbox.WhenCreated Date Local time of when the mailbox was created.
EWS.Mailbox.WhenCreatedUTC Date UTC time of when the mailbox was created.

Command Example

!ews-mailbox-list limit=1

Context Example

{
    "EWS": {
        "Mailbox": {
            "Alias": "user",
            "DisplayName": "User User",
            "DistinguishedName": "CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM",
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Guid": "<Guid>",
            "Id": "user",
            "Identity": "user",
            "Name": "user",
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PrimarySmtpAddress": "user@example.com",
            "RecipientType": "UserMailbox",
            "RecipientTypeDetails": "UserMailbox",
            "UserPrincipalName": "user@example.com"
        }
    }
}

Human Readable Output

Results of ews-mailbox-list

Alias DisplayName DistinguishedName EmailAddresses ExchangeVersion ExternalDirectoryObjectId Guid Id Identity Name OrganizationId PrimarySmtpAddress RecipientType RecipientTypeDetails UserPrincipalName
“user” “User User” “CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM” [“SPO:SPO_cac4b654-5fcf-44f0-818e-479cf8ae42ac@SPO_SP01”,”SIP:user@example.com”,”SMTP:user@example.com”] “0.20 (15.0.0)” “3fa9f28b-eb0e-463a-ba7b-8089fe9991e2” {“value”:”042e60ea-0683-41a2-a149-ca4b682dcdda”,”Guid”:”042e60ea-0683-41a2-a149-ca4b682dcdda”} “user” “user” “user” “EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration” “user@example.com” “UserMailbox” “UserMailbox” “user@example.com”

ews-cas-mailbox-list

Displays Client Access settings that are configured on mailboxes.

Base Command

ews-cas-mailbox-list

Input

Argument Name Description Required
identity The identity of the mailbox you want to view. Optional
organizational_unit The object’s location in Active Directory by which to filter the results. Optional
primary_smtp_address The primary SMTP email address of the mailbox you want to view. Cannot be used with the user_principal_name argument. Can be retrieved using the ews-user-list command. Optional
user_principal_name The UPN of the mailbox you want to view. Cannot be used with the primary_smtp_address argument. Can be retrieved using the ews-user-list command. Optional
limit The maximum number of results to retrieve. Default is 10. Default is 10. Optional

Context Output

Path Type Description
EWS.CASMailbox.ActiveSyncEnabled Boolean Whether active sync is enabled.
EWS.CASMailbox.DisplayName String The display name of the mailbox.
EWS.CASMailbox.ECPEnabled Boolean Whether the Exchange Control Panel (ECP) is enabled.
EWS.CASMailbox.EmailAddresses String The email addresses retrieved.
EWS.CASMailbox.EwsEnabled Boolean Whether the Exchange Web Services (EWS) is enabled.
EWS.CASMailbox.ExchangeVersion String Exchange version of the client access server mailbox.
EWS.CASMailbox.ExternalDirectoryObjectId String External directory object ID of the client access server mailbox.
EWS.CASMailbox.Guid String The GUID of the client access server mailbox.
EWS.CASMailbox.Identity String Identity of the client access server mailbox.
EWS.CASMailbox.ImapEnabled Boolean Whether the Internet Message Access Protocol (IMAP) is enabled.
EWS.CASMailbox.MAPIEnabled Boolean Whether the Messaging Application Programming Interface is enabled.
EWS.CASMailbox.Name String Name of the client access server mailbox.
EWS.CASMailbox.OWAEnabled Boolean Whether Outlook on the web (OWA) is enabled.
EWS.CASMailbox.OrganizationId String Organization ID
EWS.CASMailbox.PopEnabled Boolean Whether Post Office Protocol (POP) is enabled.
EWS.CASMailbox.PrimarySmtpAddress String Primary SMTP address.
EWS.CASMailbox.ServerLegacyDN String Server legacy distinguished name (DN).

Command Example

!ews-cas-mailbox-list limit=1

Context Example

{
    "EWS": {
        "CASMailbox": {
            "ActiveSyncEnabled": true,
            "DisplayName": "User User",
            "ECPEnabled": true,
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "EwsEnabled": true,
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Guid": "<Guid>",
            "Identity": "user",
            "ImapEnabled": true,
            "MAPIEnabled": true,
            "Name": "user",
            "OWAEnabled": true,
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PopEnabled": true,
            "PrimarySmtpAddress": "user@example.com",
            "ServerLegacyDN": "/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=DBXPR07MB383"
        }
    }
}

Human Readable Output

Results of ews-cas-mailbox-list

ActiveSyncEnabled DisplayName ECPEnabled EmailAddresses EwsEnabled ExchangeVersion ExternalDirectoryObjectId Guid Identity ImapEnabled MAPIEnabled Name OrganizationId OWAEnabled PopEnabled PrimarySmtpAddress ServerLegacyDN
true “User User” true [“SPO:SPO_cac4b654-5fcf-44f0-818e-479cf8ae42ac@SPO_SP01”,”SIP:user@example.com”,”SMTP:user@example.com”] true “0.20 (15.0.0)” “3fa9f28b-eb0e-463a-ba7b-8089fe9991e2” {“value”:”042e60ea-0683-41a2-a149-ca4b682dcdda”,”Guid”:”042e60ea-0683-41a2-a149-ca4b682dcdda”} “user” true true “user” “EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration” true true “user@example.com” “/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=DBXPR07MB383

ews-mailbox-permission-list

Retrieves permissions on a mailbox.

Base Command

ews-mailbox-permission-list

Input

Argument Name Description Required
identity The identity of the mailbox you want to view. Required

Context Output

Path Type Description
EWS.MailboxPermission.Identity String The specified identity of the mailbox.
EWS.MailboxPermission.Permission.AccessRights String Access rights of the mailbox.
EWS.MailboxPermission.Permission.Deny.IsPresent Boolean Whether permission is denied.
EWS.MailboxPermission.Permission.Identity String The permission identity.
EWS.MailboxPermission.Permission.InheritanceType String Permission inheritance type.
EWS.MailboxPermission.Permission.IsInherited Boolean Whether permission is inherited.
EWS.MailboxPermission.Permission.User String The permission of the user.

Command Example

!ews-mailbox-permission-list identity=user

Context Example

{
    "EWS": {
        "MailboxPermission": {
            "Identity": "user",
            "Permission": {
                "AccessRights": [
                    "FullAccess",
                    "ReadPermission"
                ],
                "Deny": {
                    "IsPresent": false
                },
                "Identity": "user",
                "InheritanceType": "All",
                "IsInherited": false,
                "User": "NT AUTHORITY\\SELF"
            }
        }
    }
}

Human Readable Output

Results of ews-mailbox-permission-list

AccessRights Deny Identity InheritanceType IsInherited User
[“FullAccess”,”ReadPermission”] {“IsPresent”:false} “user” “All” false “NT AUTHORITY\SELF”

ews-recipient-permission-list

Displays information about SendAs permissions that are configured for users.

Base Command

ews-recipient-permission-list

Input

Argument Name Description Required
identity The identity of the mailbox you want to view. Optional
limit The maximum number of results to retrieve. Default is 10. Default is 10. Optional

Context Output

Path Type Description
EWS.RecipientPermission.AccessControlType String Access control type of the recipient permission.
EWS.RecipientPermission.AccessRights Number Access rights of the recipient permission.
EWS.RecipientPermission.Identity String Identity of the recipient permission.
EWS.RecipientPermission.InheritanceType String Inheritance type of the recipient permission.
EWS.RecipientPermission.IsInherited Boolean Whether the recipient permission is inherited.
EWS.RecipientPermission.Trustee String Trustee of the recipient permission.

Command Example

!ews-recipient-permission-list identity=<Guid>

Context Example

{
    "EWS": {
        "RecipientPermission": {
            "AccessControlType": "Allow",
            "AccessRights": [
                1
            ],
            "Identity": "user",
            "InheritanceType": "None",
            "IsInherited": false,
            "Trustee": "NT AUTHORITY\\SELF"
        }
    }
}

Human Readable Output

Results of ews-mailbox-permission-list

AccessRights Deny Identity InheritanceType IsInherited User
[“FullAccess”,”ReadPermission”] {“IsPresent”:false} “user” “All” false “NT AUTHORITY\SELF”

ews-recipient-list

Displays existing recipient objects in your organization. This command returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).

Base Command

ews-recipient-list

Input

Argument Name Description Required
identity The identity of the mailbox you want to view. Optional
limit The maximum number of results to retrieve. Default is 10. Default is 10. Optional

Context Output

Path Type Description
EWS.Recipient.Alias String Recipient alias.
EWS.Recipient.DisplayName String Recipient display name.
EWS.Recipient.DistinguishedName String Recipient distinguished name.
EWS.Recipient.EmailAddresses String Recipient email addresses.
EWS.Recipient.ExchangeVersion String Recipient exchange version.
EWS.Recipient.ExternalDirectoryObjectId String Recipient external directory object ID.
EWS.Recipient.Identity String Recipient identity.
EWS.Recipient.Name String Recipient name.
EWS.Recipient.OrganizationId String Recipient organization ID.
EWS.Recipient.PrimarySmtpAddress String Recipient primary SMTP address.
EWS.Recipient.RecipientType String Recipient type.
EWS.Recipient.RecipientTypeDetails String Recipient type details.

Command Example

!ews-recipient-list identity=<ExternalDirectoryObjectId>

Context Example

{
    "EWS": {
        "Recipient": {
            "Alias": "user",
            "DisplayName": "User User",
            "DistinguishedName": "CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM",
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Identity": "user",
            "Name": "user",
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PrimarySmtpAddress": "user@example.com",
            "RecipientType": "UserMailbox",
            "RecipientTypeDetails": "UserMailbox"
        }
    }
}

Human Readable Output

Results of ews-recipient-list

Alias DisplayName DistinguishedName EmailAddresses ExchangeVersion ExternalDirectoryObjectId Identity Name OrganizationId PrimarySmtpAddress RecipientType RecipientTypeDetails
“user” “user” “CN=user_Identity,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM” [“SPO:SPO_SP00@SPO_SP01”,”SMTP:user@example.com”] “0.10 (14.0.100)” “Identity” “user_Identity” “user_Identity” “EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration” “user@example.com” “MailUniversalDistributionGroup” “GroupMailbox”

ews-new-tenant-allow-block-list-items

Add new items to the Tenant Allow/Block Lists. Uses PowerShell New-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-new-tenant-allow-block-list-items

Input

Argument Name Description Required
entries Entries to add to the list. Separate multiple entries with a comma (e.g. “Item1,Item2”). Required
list_type List type to add items to. Required
list_subtype List subtype to add items to. Optional
action Action to set for new entries Required
notes Notes to include on new list entries Optional
expiration_date Enter a specific date and time for the new entries to expire using format “YYYY-MM-DD HH:MM:SSz” for UTC time. Alternately, a PowerShell GetDate statement can be used. Optional
no_expiration Specify whether to create list entries with no expiration date. Cannot be used with “expiration_date”. If left false and no expiration date is set, default of 30 days will be used. Optional

Context Output

Path Type Description
EWS.NewTenantBlocks.Action String List type (‘Block’ or ‘Allow’)
EWS.NewTenantBlocks.EntryValueHash String Entry Value Hash
EWS.NewTenantBlocks.Error String Error (if any) returned by remote command
EWS.NewTenantBlocks.ExpirationDate String DateTime the entry will expire and be removed
EWS.NewTenantBlocks.Identity String Unique identifier for the entry
EWS.NewTenantBlocks.LastModifiedDateTime String DateTime of last modification
EWS.NewTenantBlocks.ListSubType String List sub type (Tenant or AdvancedDelivery)
EWS.NewTenantBlocks.ModifiedBy String User / App Registration which last modified this entry
EWS.NewTenantBlocks.Notes String Custom notes added to the entry.
EWS.NewTenantBlocks.ObjectState String State of the object (e.g. New/Modified/Deleted)
EWS.NewTenantBlocks.PSComputerName String Name of Remote Powershell endpoint
EWS.NewTenantBlocks.PSShowComputerName Bool Flag whether or not remote computer name is shown in PS prompt
EWS.NewTenantBlocks.RunspaceId String RunspaceID of the entry
EWS.NewTenantBlocks.SubmissionID String SubmissionID of the entry
EWS.NewTenantBlocks.SysManaged Bool SysManaged property of the entry
EWS.NewTenantBlocks.Value String The value of the new entry created

Command Example

!ews-new-tenant-allow-block-list-items action=Block list_type=sender entries="attacker@phishingsite.com" notes="Email observed in a phishing campaign."

Context Example

{
    "Action": "Block",
    "EntryValueHash": "d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=",
    "Error": null,
    "ExpirationDate": "2022-06-15T19:30:52.6071551Z",
    "Identity": "RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPhAAAA0",
    "LastModifiedDateTime": "2022-05-16T19:30:52.7320883Z",
    "ListSubType": "Tenant",
    "ModifiedBy": "",
    "Notes": "Email observed in a phishing campaign.",
    "ObjectState": "New",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "RunspaceId": "fe0186a8-6ce6-487d-bd65-a9869f60ffcd",
    "SubmissionID": "",
    "SysManaged": false,
    "Value": "attacker@phishingsite.com"
}

Human Readable Output

Results of ews-new-tenant-allow-block-list-items

Action EntryValueHash Error ExpirationDate Identity LastModifiedDateTime ListSubType ModifiedBy Notes ObjectState PSComputerName PSShowComputerName RunspaceId SubmissionID SysManaged Value
Block d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=   {“value”:”2022-06-15T19:34:01.2028448Z”,”DateTime”:”Wednesday, June 15, 2022 7:34:01 PM”} RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0 {“value”:”2022-05-16T19:34:01.2652934Z”,”DateTime”:”Monday, May 16, 2022 7:34:01 PM”} Tenant   Email observed in a phishing campaign. New outlook.office365.com false {“value”:”8f736b87-f951-4b6b-aa21-e358720c44e3”,”Guid”:”8f736b87-f951-4b6b-aa21-e358720c44e3”}   false attacker@phishingsite.com

ews-get-tenant-allow-block-list-items

Retrieve current Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-get-tenant-allow-block-list-items

Input

Argument Name Description Required
list_type List type to retrieve items from. Required
list_subtype List subtype to retrieve items from. Optional
action Action to filter entries by. Required
expiration_date Enter a specific date and time to filter entries by using format “YYYY-MM-DD HH:MM:SSz” for UTC time. Alternately, a PowerShell GetDate statement can be used. Optional
no_expiration Filter list items that are set to never expire. Optional
entry Specific entry value to retrieve. Optional

Context Output

Path Type Description
EWS.CurrentTenantBlocks.Action String List type (‘Block’ or ‘Allow’)
EWS.CurrentTenantBlocks.EntryValueHash String Entry Value Hash
EWS.CurrentTenantBlocks.Error Bool Error (if any) returned by remote command
EWS.CurrentTenantBlocks.ExpirationDate String DateTime the entry will expire and be removed
EWS.CurrentTenantBlocks.Identity String Unique identifier for the entry
EWS.CurrentTenantBlocks.LastModifiedDateTime String DateTime of last modification
EWS.CurrentTenantBlocks.ListSubType String List sub type (Tenant or AdvancedDelivery)
EWS.CurrentTenantBlocks.ModifiedBy String User / App Registration which last modified this entry
EWS.CurrentTenantBlocks.Notes String Custom notes added to the entry.
EWS.CurrentTenantBlocks.ObjectState String State of the object (e.g. New/Modified/Deleted)
EWS.CurrentTenantBlocks.PSComputerName String Name of Remote Powershell endpoint
EWS.CurrentTenantBlocks.PSShowComputerName Bool Flag whether or not remote computer name is shown in PS prompt
EWS.CurrentTenantBlocks.RunspaceId String RunspaceID of the entry
EWS.CurrentTenantBlocks.SubmissionID String SubmissionID of the entry
EWS.CurrentTenantBlocks.SysManaged Bool SysManaged property of the entry
EWS.CurrentTenantBlocks.Value String The value of the new entry created

Command Example

!ews-get-tenant-allow-block-list-items action=Block list_type=sender

Context Example

[
    {
        "Action": "Block",
        "EntryValueHash": "d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=",
        "Error": null,
        "ExpirationDate": "2022-06-15T19:34:01.2028448Z",
        "Identity": "RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0",
        "LastModifiedDateTime": "2022-05-16T19:34:01.2652934Z",
        "ListSubType": "Tenant",
        "ModifiedBy": "",
        "Notes": "Email observed in a phishing campaign.",
        "ObjectState": "Unchanged",
        "PSComputerName": "outlook.office365.com",
        "PSShowComputerName": false,
        "RunspaceId": "010da4cf-2d47-4b8a-a882-4bd6885faff1",
        "SubmissionID": "",
        "SysManaged": false,
        "Value": "attacker@phishingsite.com"
    }
]

Human Readable Output

Results of ews-get-tenant-allow-block-list-items

Action EntryValueHash Error ExpirationDate Identity LastModifiedDateTime ListSubType ModifiedBy Notes ObjectState PSComputerName PSShowComputerName RunspaceId SubmissionID SysManaged Value
Block d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=   {“value”:”2022-06-15T19:34:01.2028448Z”,”DateTime”:”Wednesday, June 15, 2022 7:34:01 PM”} RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0 {“value”:”2022-05-16T19:34:01.2652934Z”,”DateTime”:”Monday, May 16, 2022 7:34:01 PM”} Tenant   Email observed in a phishing campaign. Unchanged outlook.office365.com false {“value”:”feada07c-99b7-48e9-a562-a755073522ff”,”Guid”:”feada07c-99b7-48e9-a562-a755073522ff”}   false attacker@phishingsite.com

ews-get-tenant-allow-block-list-count

Retrieve current count of defined Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-get-tenant-allow-block-list-count

Input

Argument Name Description Required
list_type List type to retrieve items from. Optional
list_subtype List subtype to retrieve items from. Optional

Context Output

Path Type Description
EWS.CurrentListCount.Count Number Number of entries presently in the specified list
EWS.CurrentListCount.ListSubType String List sub type (Tenant or AdvancedDelivery)
EWS.CurrentListCount.ListType String List type

Command Example

!ews-get-tenant-allow-block-list-count list_type=sender

Context Example

{
    "Count": 2,
    "ListSubType": "Tenant",
    "ListType": "sender"
}

Human Readable Output

Results of ews-get-tenant-allow-block-list-count

Count ListSubType ListType
2 Tenant sender

ews-remove-tenant-allow-block-list-items

Remove items from the Tenant Allow/Block Lists. You can delete items by their value or by unique ID. Uses PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-remove-tenant-allow-block-list-items

Input

Argument Name Description Required
entries Entries to remove from the list. Either use this OR ‘ids’ to specify items to remove. Separate multiple entries with a comma (e.g. “Item1,Item2”). Optional
ids Entry IDs to remove from the list. Either use this OR ‘entries’ to specify items to remove. Separate multiple entries with a comma (e.g. “Item1,Item2”). Optional
list_type List type to remove items from. Required
list_subtype List subtype to remove items from. Optional

Context Output

Path Type Description
EWS.RemovedTenantBlocks.Action String Action
EWS.RemovedTenantBlocks.EntryValueHash String Null for deleted items.
EWS.RemovedTenantBlocks.Error String Null for deleted items.
EWS.RemovedTenantBlocks.ExpirationDate String Null for deleted items.
EWS.RemovedTenantBlocks.Identity String Blank for deleted items.
EWS.RemovedTenantBlocks.LastModifiedDateTime String Null for deleted items.
EWS.RemovedTenantBlocks.ListSubType String Null for deleted items.
EWS.RemovedTenantBlocks.ModifiedBy String Null for deleted items.
EWS.RemovedTenantBlocks.Notes String Null for deleted items.
EWS.RemovedTenantBlocks.ObjectState String State of the object (Deleted)
EWS.RemovedTenantBlocks.PSComputerName String Name of Remote Powershell endpoint
EWS.RemovedTenantBlocks.PSShowComputerName Bool Flag whether or not remote computer name is shown in PS prompt
EWS.RemovedTenantBlocks.RunspaceId String RunspaceID of the entry
EWS.RemovedTenantBlocks.SubmissionID String SubmissionID of the entry
EWS.RemovedTenantBlocks.SysManaged Bool SysManaged property of the entry
EWS.RemovedTenantBlocks.Value String The value of the entry that was removed

Command Example

!ews-remove-tenant-allow-block-list-items list_type=sender entries="attacker2@phishingsite.com"

Context Example

{
    "Action": "0",
    "EntryValueHash": null,
    "Error": null,
    "ExpirationDate": null,
    "Identity": "",
    "LastModifiedDateTime": null,
    "ListSubType": null,
    "ModifiedBy": null,
    "Notes": null,
    "ObjectState": "Deleted",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "RunspaceId": "efa88be5-7342-4b77-af2f-99dd2d914300",
    "SubmissionID": null,
    "SysManaged": null,
    "Value": "attacker2@phishingsite.com"
}

Human Readable Output

Results of ews-remove-tenant-allow-block-list-items

Action EntryValueHash Error ExpirationDate Identity LastModifiedDateTime ListSubType ModifiedBy Notes ObjectState PSComputerName PSShowComputerName RunspaceId SubmissionID SysManaged Value
0                 Deleted outlook.office365.com false {“value”:”cd58060e-d033-4cdb-814e-9f9748fdf78c”,”Guid”:”cd58060e-d033-4cdb-814e-9f9748fdf78c”}     attacker@phishingsite.com

ews-export-quarantinemessage

Export quarantine messages.

Base Command

ews-export-quarantinemessage

Input

Argument Name Description Required
identities A comma-separated list of identities of the messages to export. Optional
identity The identity of a single message to export. Optional
compress_output Specify whether the output should be compressed. Optional
entity_type The type of entity being exported. Optional
force_conversion_to_mime Specify whether to force conversion to MIME format. Optional
password Password to encrypt the exported file. Using this argument requires ‘compress_output’ argument to be set to true. Optional
reason_for_export Reason for exporting the message. Using this argument requires ‘compress_output’ argument to be set to true. Optional
recipient_address Filters the results by the recipient’s email address. Optional

Context Output

Path Type Description
EWS.ExportQuarantineMessage.BodyEncoding String Encoding used for the body of the message.
EWS.ExportQuarantineMessage.Eml String The email message in Base64 encoding.
EWS.ExportQuarantineMessage.Identity String Unique identifier for the retrieved message.
EWS.ExportQuarantineMessage.Organization Boolean Identifier for the organization associated with the message.

Command Example

!ews-export-quarantinemessage identity="12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab"

Context Example

{
    "BodyEncoding": "Base64",
    "Eml": "TmV2ZXIgZ29ubmEgZ2l2ZSB5b3UgdXAsIG5ldmVyIGdvbm5hIGxldCB5b3UgZG93biwgbmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQgZGVzZXJ0IHlvdQo=",
    "Identity": "12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab",
    "Organization": "c0ffee13-beef-dead-beef-0123456789ab"
}

Human Readable Output

Results of ews-export-quarantinemessage

BodyEncoding Eml Identity Organization
Base64 TmV2ZXIgZ29ubmEgZ2l2ZSB5b3UgdXAsIG5ldmVyIGdvbm5hIGxldCB5b3UgZG93biwgbmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQgZGVzZXJ0IHlvdQo= 12345678-beef-dead-beef-0123456789ab\c0ffee13-beef-dead-beef-0123456789ab c0ffee13-beef-dead-beef-0123456789ab

ews-get-quarantinemessage

Retrieve quarantine messages.

Base Command

ews-get-quarantinemessage

Input

Argument Name Description Required
identity The identity of a single message to retrieve. Optional
entity_type Filters by entity workload type. Optional
recipient_address Filters by the recipient email address. Optional
sender_address Filters by the sender email address. Optional
teams_conversation_types Filters by one or more Teams conversation types. Deprecated, as this parameter is not available in the PowerShell type used in this integration. Optional
direction The message direction (inbound or outbound). Optional
domain Domain associated with the message. Optional
end_expires_date End date for the message expiration. Optional
end_received_date The end of the received message date range. Supports the format ‘MM/dd/yyyy HH:mm:ss’. Optional
include_messages_from_blocked_sender_address Whether to include messages from blocked sender addresses. Optional
message_id The internet message ID (client ID) found in the email headers. Optional
my_items Include only items belonging to the user. Optional
page Page number for pagination. Optional
page_size The number of items per page. Maximum is 1000. Default is 50. Optional
policy_name Name of the policy associated with the message. Optional
policy_types Filter by types of policies. Optional
quarantine_types Filters by one or more quarantine types. Optional
recipient_tag Filters by the priority tag associated with the recipient. Optional
release_status Filters by the message release status. Optional
reported Whether to include only reported messages. Optional
start_expires_date Start date for the message expiration. Optional
start_received_date The start of the received message date range. Supported format ‘MM/dd/yyyy HH:mm:ss’. Optional
subject Subject of the message. Optional
type Type of the message. Optional

Context Output

Path Type Description
EWS.GetQuarantineMessage.ApprovalId string Approval ID of the message.
EWS.GetQuarantineMessage.ApprovalUPN string User Principal Name (UPN) of the approver.
EWS.GetQuarantineMessage.CustomData unknown Custom data associated with the message.
EWS.GetQuarantineMessage.DeletedForRecipients string List of recipients for whom the message was deleted.
EWS.GetQuarantineMessage.Direction string Direction of the message (Inbound/Outbound).
EWS.GetQuarantineMessage.EntityType string Entity type of the message.
EWS.GetQuarantineMessage.Expires date Expiry date of the message.
EWS.GetQuarantineMessage.Identity string Unique identifier for the message.
EWS.GetQuarantineMessage.MessageId string Message ID of the email.
EWS.GetQuarantineMessage.MoveToQuarantineAdminActionTakenBy string Admin action taken by.
EWS.GetQuarantineMessage.MoveToQuarantineApprovalId string Approval ID for moving to quarantine.
EWS.GetQuarantineMessage.Organization string Identifier for the organization associated with the message.
EWS.GetQuarantineMessage.OverrideReason string Reason for overriding the message.
EWS.GetQuarantineMessage.OverrideReasonIntValue number Integer value of the override reason.
EWS.GetQuarantineMessage.PermissionToAllowSender boolean Permission to allow the sender.
EWS.GetQuarantineMessage.PermissionToBlockSender boolean Permission to block the sender.
EWS.GetQuarantineMessage.PermissionToDelete boolean Permission to delete the message.
EWS.GetQuarantineMessage.PermissionToDownload boolean Permission to download the message.
EWS.GetQuarantineMessage.PermissionToPreview boolean Permission to preview the message.
EWS.GetQuarantineMessage.PermissionToRelease boolean Permission to release the message.
EWS.GetQuarantineMessage.PermissionToRequestRelease boolean Permission to request release of the message.
EWS.GetQuarantineMessage.PermissionToViewHeader boolean Permission to view the header of the message.
EWS.GetQuarantineMessage.PolicyName string Name of the policy applied to the message.
EWS.GetQuarantineMessage.PolicyType string Type of the policy applied to the message.
EWS.GetQuarantineMessage.QuarantineTypes string Types of quarantine applied to the message.
EWS.GetQuarantineMessage.QuarantinedUser string List of users quarantined.
EWS.GetQuarantineMessage.ReceivedTime date Time the message was received.
EWS.GetQuarantineMessage.RecipientAddress string List of recipient email addresses.
EWS.GetQuarantineMessage.RecipientCount number Number of recipients.
EWS.GetQuarantineMessage.RecipientTag string Tags associated with the recipient.
EWS.GetQuarantineMessage.ReleaseStatus string Release status of the message.
EWS.GetQuarantineMessage.Released boolean Whether the message was released.
EWS.GetQuarantineMessage.ReleasedBy string List of users who released the message.
EWS.GetQuarantineMessage.ReleasedCount number Number of times the message was released.
EWS.GetQuarantineMessage.ReleasedUser string List of users who released the message.
EWS.GetQuarantineMessage.Reported boolean Whether the message was reported.
EWS.GetQuarantineMessage.SenderAddress string Email address of the sender.
EWS.GetQuarantineMessage.Size number Size of the message in bytes.
EWS.GetQuarantineMessage.SourceId string Source ID of the message.
EWS.GetQuarantineMessage.Subject string Subject of the message.
EWS.GetQuarantineMessage.SystemReleased boolean Whether the system released the message.
EWS.GetQuarantineMessage.TagName string Tag name associated with the message.
EWS.GetQuarantineMessage.TeamsConversationType string Teams conversation type associated with the message.
EWS.GetQuarantineMessage.Type string Type of the message.

Command Example


#### Context Example

```json
{
[
    {
        "ApprovalId": "",
        "ApprovalUPN": "",
        "CustomData": null,
        "DeletedForRecipients": [],
        "Direction": "Outbound",
        "EntityType": "Email",
        "Expires": "2024-07-18T13:20:02.7166413+00:00",
        "Identity": "12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab",
        "MessageId": "\u003c12345678-beef-dead-beef-0123456789ab@123456.789a.bcde.example.com\u003e",
        "MoveToQuarantineAdminActionTakenBy": "",
        "MoveToQuarantineApprovalId": "",
        "Organization": "c0ffee13-beef-dead-beef-0123456789ab",
        "OverrideReason": "None",
        "OverrideReasonIntValue": 0,
        "PermissionToAllowSender": true,
        "PermissionToBlockSender": false,
        "PermissionToDelete": true,
        "PermissionToDownload": true,
        "PermissionToPreview": true,
        "PermissionToRelease": true,
        "PermissionToRequestRelease": false,
        "PermissionToViewHeader": false,
        "PolicyName": "Default",
        "PolicyType": "HostedContentFilterPolicy",
        "QuarantineTypes": "HighConfPhish",
        "QuarantinedUser": [],
        "ReceivedTime": "2024-07-02T13:20:02.7166413+00:00",
        "RecipientAddress": [
            "admin@example.com"
        ],
        "RecipientCount": 1,
        "RecipientTag": [
            ""
        ],
        "ReleaseStatus": "NOTRELEASED",
        "Released": false,
        "ReleasedBy": [],
        "ReleasedCount": 0,
        "ReleasedUser": [],
        "Reported": false,
        "SenderAddress": "alerts@example.com",
        "Size": 31218,
        "SourceId": "",
        "Subject": "Informational-severity alert: Tenant Allow/Block List entry is about to expire",
        "SystemReleased": false,
        "TagName": "AdminOnlyAccessPolicy",
        "TeamsConversationType": "",
        "Type": "High Confidence Phish"
    },
    {
        "ApprovalId": "",
        "ApprovalUPN": "",
        "CustomData": null,
        "DeletedForRecipients": [],
        "Direction": "Inbound",
        "EntityType": "Email",
        "Expires": "2024-07-13T10:59:12.7581841+00:00",
        "Identity": "12345678-beef-dead-beef-0123456789ac\\c0ffee13-beef-dead-beef-0123456789ac",
        "MessageId": "\u003c12345678-beef-dead-beef-0123456789ac@123456.789a.bcde.example.com\u003e",
        "MoveToQuarantineAdminActionTakenBy": "",
        "MoveToQuarantineApprovalId": "",
        "Organization": "c0ffee13-beef-dead-beef-0123456789ac",
        "OverrideReason": "None",
        "OverrideReasonIntValue": 0,
        "PermissionToAllowSender": true,
        "PermissionToBlockSender": false,
        "PermissionToDelete": true,
        "PermissionToDownload": true,
        "PermissionToPreview": true,
        "PermissionToRelease": true,
        "PermissionToRequestRelease": false,
        "PermissionToViewHeader": false,
        "PolicyName": "testing_quarantine_release",
        "PolicyType": "HostedContentFilterPolicy",
        "QuarantineTypes": "HighConfPhish",
        "QuarantinedUser": [],
        "ReceivedTime": "2024-06-28T10:59:12.7581841+00:00",
        "RecipientAddress": [
            "user@example.com"
        ],
        "RecipientCount": 1,
        "RecipientTag": [
            ""
        ],
        "ReleaseStatus": "RELEASED",
        "Released": true,
        "ReleasedBy": [
            "SystemMailbox{deadbeef-dead-beef-dead-beefdeadbeef}@example.com"
        ],
        "ReleasedCount": 1,
        "ReleasedUser": [],
        "Reported": false,
        "SenderAddress": "sender@example.com",
        "Size": 14781,
        "SourceId": "",
        "Subject": "Check the inbox",
        "SystemReleased": false,
        "TagName": "testing_release",
        "TeamsConversationType": "",
        "Type": "High Confidence Phish"
    }
]
}

Human Readable Output

Results of ews-get-quarantinemessage

ApprovalId ApprovalUPN CustomData DeletedForRecipients Direction EntityType Expires Identity MessageId MoveToQuarantineAdminActionTakenBy MoveToQuarantineApprovalId Organization OverrideReason OverrideReasonIntValue PermissionToAllowSender PermissionToBlockSender PermissionToDelete PermissionToDownload PermissionToPreview PermissionToRelease PermissionToRequestRelease PermissionToViewHeader PolicyName PolicyType QuarantineTypes QuarantinedUser ReceivedTime RecipientAddress RecipientCount RecipientTag ReleaseStatus Released ReleasedBy ReleasedCount ReleasedUser Reported SenderAddress Size SourceId Subject SystemReleased TagName TeamsConversationType Type
        Outbound Email 2024-07-18T13:20:02.7166413+00:00 12345678-beef-dead-beef-0123456789ab\c0ffee13-beef-dead-beef-0123456789ab \u003c12345678-beef-dead-beef-0123456789ab@123456.789a.bcde.example.com\u003e     c0ffee13-beef-dead-beef-0123456789ab None 0 true false true true true true false false Default HostedContentFilterPolicy HighConfPhish [] 2024-07-02T13:20:02.7166413+00:00 [“admin@example.com”] 1 [””] NOTRELEASED false [] 0 [] false alerts@example.com 31218   Informational-severity alert: Tenant Allow/Block List entry is about to expire false AdminOnlyAccessPolicy   High Confidence Phish
        Inbound Email 2024-07-13T10:59:12.7581841+00:00 12345678-beef-dead-beef-0123456789ac\c0ffee13-beef-dead-beef-0123456789ac \u003c12345678-beef-dead-beef-0123456789ac@123456.789a.bcde.example.com\u003e     c0ffee13-beef-dead-beef-0123456789ac None 0 true false true true true true false false testing_quarantine_release HostedContentFilterPolicy HighConfPhish [] 2024-06-28T10:59:12.7581841+00:00 [“user@example.com”] 1 [””] RELEASED true [“SystemMailbox{deadbeef-dead-beef-dead-beefdeadbeef}@example.com”] 1 [] false sender@example.com 14781   Check the inbox false testing_release   High Confidence Phish

ews-release-quarantinemessage

Releases the quarantined messages. Uses the PowerShell Release-QuarantineMessage cmdlet.

Base Command


#### Input

| **Argument Name**      | **Description**                                            | **Required** |
|------------------------|------------------------------------------------------------|--------------|
| user                   | The email address of the user you want to release the quarantined message to.           | Optional |
| identities             | A comma-separated list of identities of the messages to release. | Optional |
| identity               | The identity of a single message to release.               | Optional |
| release_to_all         | Specify whether to release the message to all recipients.  | Optional |
| allow_sender           | Specify whether to allow the sender.                       | Optional |
| entity_type            | The entity workload type being released.                         | Optional |
| force                  | Specify whether to force the release.                      | Optional |
| report_false_positive  | Specify whether to report the message as a false positive. | Optional |
| action_type            | The action to perform on the quarantined message.     | Optional |

#### Context Output

There are no context outputs for this command.

#### Human Readable Output
>
>The message with identity 12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab has been sent for release from quarantine.

### ews-junk-rules-get

***
Gets junk rules for the specified mailbox.

#### Base Command

`ews-junk-rules-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| mailbox | ID of the mailbox for which to get junk rules. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| EWS.Rule.Junk.BlockedSendersAndDomains | String | Blocked senders and domains list. |
| EWS.Rule.Junk.ContactsTrusted | Boolean | If true, contacts are trusted by default. |
| EWS.Rule.Junk.Email | String | Junk rule mailbox. |
| EWS.Rule.Junk.Enabled | Boolean | If true, junk rule is enabled. |
| EWS.Rule.Junk.Identity | String | Junk rule identity. |
| EWS.Rule.Junk.MailboxOwnerId | String | Mail box owner ID. |
| EWS.Rule.Junk.TrustedListsOnly | Boolean | If true, only a list defined in the trusted lists are trusted. |
| EWS.Rule.Junk.TrustedRecipientsAndDomains | String | List of trusted recipients and domains. |
| EWS.Rule.Junk.TrustedSendersAndDomains | String | List of trusted senders and domains. |

#### Command Example

```!ews-junk-rules-get mailbox="xsoar@dev.onmicrosoft.com"```

#### Context Example

```json
{
    "EWS": {
        "Rule": {
            "Junk": {
                "BlockedSendersAndDomains": [
                    "user1@gmail.com",
                    "user2@gmail.com"
                ],
                "ContactsTrusted": false,
                "Enabled": false,
                "Identity": "xsoar",
                "MailboxOwnerId": "xsoar",
                "TrustedListsOnly": false,
                "TrustedRecipientsAndDomains": [
                  "user1@gmail.com",
                  "user2@gmail.com"
                ],
                "TrustedSendersAndDomains": [
                  "user1@gmail.com",
                  "user2@gmail.com"
                ]
            }
        }
    }
}

Human Readable Output

EWS extension - ‘xsoar@dev.onmicrosoft.com’ Junk rules

BlockedSendersAndDomains ContactsTrusted Enabled TrustedListsOnly TrustedSendersAndDomains
[“user1@gmail.com”,”user2@gmail.com”] False False False [“user1@gmail.com”,”user2@gmail.com”]

ews-junk-rules-set

Sets junk rules for the specified mailbox.

Base Command

ews-junk-rules-set

Input

Argument Name Description Required
mailbox ID of the mailbox for which to set junk rules. Required
add_blocked_senders_and_domains Comma-separated list of blocked senders and domains to add to the mailbox. Optional
remove_blocked_senders_and_domains Comma-separated list of blocked senders and domains to remove from the mailbox. Optional
add_trusted_senders_and_domains Comma-separated list of trusted senders and domains to add to the mailbox. Optional
remove_trusted_senders_and_domains Comma-separated list of trusted senders and domains to remove from the mailbox. Optional
trusted_lists_only If true, trust only lists defined in the trusted lists. Can be “true” or “false”. Possible values are: true, false. Optional
contacts_trusted If true, contacts are trusted by default. Can be “true” or “false”. Possible values are: true, false. Optional
enabled If true, the junk rule is enabled. Can be “true” or “false”. Possible values are: true, false. Optional

Context Output

There is no context output for this command.

Command Example

!ews-junk-rules-set mailbox="xsoar@dev.onmicrosoft.com" add_blocked_senders_and_domains="test@gmail.com" add_trusted_senders_and_domains="dev.onmicrosoft.com"

Human Readable Output

EWS extension - ‘xsoar@dev.onmicrosoft.com’ Junk rules modified!

ews-global-junk-rules-set

Sets junk rules in all managed accounts.

Base Command

ews-global-junk-rules-set

Input

Argument Name Description Required
add_blocked_senders_and_domains Comma-separated list of blocked senders and domains to add to the mailbox. Optional
remove_blocked_senders_and_domains Comma-separated list of blocked senders and domains to remove from the mailbox. Optional
add_trusted_senders_and_domains Comma-separated list of trusted senders and domains to add to the mailbox. Optional
remove_trusted_senders_and_domains Comma-separated list of trusted senders and domains to remove from the mailbox. Optional
trusted_lists_only If true, trust only lists defined in the trusted lists. Can be “true” or “false”. Possible values are: true, false. Optional
contacts_trusted If true, contacts are trusted by default. Can be “true” or “false”. Possible values are: true, false. Optional
enabled If true, the junk rule is enabled. Can be “true” or “false”. Possible values are: true, false. Optional

Context Output

There is no context output for this command.

Command Example

!ews-global-junk-rules-set add_blocked_senders_and_domains="test@demisto.com" add_trusted_senders_and_domains="demisto.com"

Human Readable Output

EWS extension - Junk rules globally modified!

ews-message-trace-get

Searches message data for the last 10 days. If you run this command without any arguments, only data from the last 48 hours is returned.
If you enter a start date that is older than 10 days, you will receive an error and the command will return no results.
This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.

Base Command

ews-message-trace-get

Input

Argument Name Description Required
sender_address The sender_address parameter filters the results by the sender’s email address. You can specify multiple values separated by commas.
.		 Optional
recipient_address The recipient_address parameter filters the results by the recipient’s email address. You can specify multiple values separated by commas.
.		 Optional
from_ip The from_ip parameter filters the results by the source IP address.
For incoming messages, the value of from_ip is the public IP address of the SMTP email server that sent the message.
For outgoing messages from Exchange Online, the value is blank.
.		 Optional
to_ip The to_ip parameter filters the results by the destination IP address.
For outgoing messages, the value of to_ip is the public IP address in the resolved MX record for the destination domain.
For incoming messages to Exchange Online, the value is blank.
.		 Optional
message_id The message_id parameter filters the results by the Message-ID header field of the message.
This value is also known as the Client ID. The format of the Message-ID depends on the messaging server that sent the message.
The value should be unique for each message. However, not all messaging servers create values for the Message-ID in the same way.
Be sure to include the full Message ID string (which may include angle brackets) and enclose the value in quotation marks (for example,”d9683b4c-127b-413a-ae2e-fa7dfb32c69d@DM3NAM06BG401.Eop-nam06.prod.protection.outlook.com”).
.		 Optional
message_trace_id The message_trace_id parameter can be used with the recipient address to uniquely identify a message trace and obtain more details.
A message trace ID is generated for every message that’s processed by the system.
.		 Optional
page The page number of the results you want to view.
Can be an integer between 1 and 1000. The default value is 1.
. Default is 1.		 Optional
page_size The maximum number of entries per page.
Can be an integer between 1 and 5000. The default value is 100.
. Default is 100.		 Optional
start_date The start date of the date range.
Use the short date format that’s defined in the Regional Options settings on the computer where you’re running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy,
enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day.
If you enter the date and time of day, enclose the value in quotation marks (“), for example, “09/01/2018 5:00 PM”.
Valid input for this parameter is from 10 days - now ago. The default value is 48 hours ago.
.		 Optional
end_date The end date of the date range.
Use the short date format that’s defined in the Regional Options settings on the computer where you’re running the command.
For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.
You can enter the date only, or you can enter the date and time of day.
If you enter the date and time of day, enclose the value in quotation marks (“), for example, “09/01/2018 5:00 PM”.
Valid input for this parameter is from start_date - now. The default value is now.
.		 Optional
status The status of the message. Can be one of the following:
GettingStatus: The message is waiting for status update.
 Failed: Message delivery was attempted and it failed or the message was filtered as spam or malware, or by transport rules.
Pending: Message delivery is underway or was deferred and is being retried.
 Delivered: The message was delivered to its destination.
Expanded: There was no message delivery because the message was addressed to a distribution group and the membership of the distribution was expanded.
 Quarantined: The message was quarantined.
* FilteredAsSpam: The message was marked as spam.
. Possible values are: GettingStatus, Failed, Pending, Delivered, Expanded, Quarantined, FilteredAsSpam.		 Optional

Context Output

Path Type Description
EWS.MessageTrace.FromIP String The public IP address of the SMTP email server that sent the message.
EWS.MessageTrace.ToIP String The public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, the value is blank.
EWS.MessageTrace.Index Number Message index in pagination. (Index starts from 0)
EWS.MessageTrace.MessageId String Message-ID header field of the message.
EWS.MessageTrace.MessageTraceId String Message trace ID of the message.
EWS.MessageTrace.Organization String Message trace organization source.
EWS.MessageTrace.Received Date Message receive time.
EWS.MessageTrace.RecipientAddress String Message recipients address.
EWS.MessageTrace.SenderAddress String Message sender address.
EWS.MessageTrace.Size Number Message size in bytes.
EWS.MessageTrace.StartDate Date Message trace start date.
EWS.MessageTrace.EndDate Date Message trace end date.
EWS.MessageTrace.Status String Message status.
EWS.MessageTrace.Subject String Message subject.

Command Example


#### Context Example

```json
{
    "EWS": {
        "MessageTrace": [
            {
                "EndDate": "2021-01-03T06:14:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 1,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:45:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:14:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            },
            {
                "EndDate": "2021-01-03T06:15:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 2,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:46:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:15:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            }
        ]
    }
}

Human Readable Output

EWS extension - Messages trace

EndDate FromIP Index MessageId MessageTraceId Organization Received RecipientAddress SenderAddress Size StartDate Status Subject ToIP
1/3/2021 6:14:14 AM 8.8.8.8 0 xxx xxxx microsoft.com 1/3/2021 4:45:36 AM xsoar@dev.microsoft.com xsoar@dev.onmicrosoft.com 6975 1/1/2021 6:14:14 AM Delivered Test mail  
1/3/2021 6:15:14 AM 8.8.8.8 1 xxx xxxx microsoft.com 1/3/2021 4:46:36 AM xsoar@dev.microsoft.com xsoar@dev.onmicrosoft.com 6975 1/1/2021 6:15:14 AM Delivered Test mail  

ews-message-trace-list

You can use this command to search message data for the last 90 days. If you run this command without any arguments, only data from the last 48 hours is returned.
You can only return 10 days worth of data per query.
This command returns a maximum of 5,000 results. If your data exceeds the result size, consider splitting it up using shorter start_date and end_date intervals.
For information on how to use pagination, see the Pagination section below.

Pagination Information:
Pagination isn’t supported in this command due to API limitations. To query subsequent data, use the starting_recipient_address and end_date parameters with the values from the Recipient address and Received Time properties respectively of the previous result in the next query.
For more information, Click for the Microsoft API Documentation

Best Practices:

  • Use the limit argument to adjust the size of your results.
  • Be as precise as possible. Narrow the gap between start_date and end_date and use additional arguments (for example, starting_recipient_address) where possible.
  • Use message_id where possible (required for messages sent to more than 1000 recipients).

Base Command

ews-message-trace-list

Input

Argument Name Description Required
sender_address A comma-separated list of sender email addresses by which to filter the results. Optional
recipient_address A comma-separated list of recipient email addresses by which to filter the results. Optional
from_ip The source IP address used to filter results. For incoming messages, from_ip is the public IP of the SMTP server that sent the message. For outgoing messages from Exchange Online, the value is blank. Optional
to_ip The destination IP address used to filter results. For outgoing messages, the to_ip value is the public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, this value is blank. Optional
message_id A comma-separated list of Message-ID header fields used to filter results. This value is also known as the Client ID. The format of the Message-ID depends on the messaging server that sent the message and should be unique for each message. However, not all servers generate Message-ID values in the same way. Include the full Message-ID string (which may contain angle brackets) and enclose each value in quotation marks. Optional
message_trace_id The message trace ID used with the recipient address to uniquely identify a message trace and obtain more details. A message trace ID is generated for every message that’s processed by the system. Optional
start_date The start date of the date range. Use the short date format that’s defined in the Regional Options settings on the computer where you’re running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks (“), for example, “09/01/2018 5:00 PM”. Valid input for this parameter is from 90 days ago until now. Default is 48 hours ago. Optional
end_date The end date of the date range. Use the short date format that’s defined in the Regional Options settings on the computer where you’re running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks (“), for example, “09/01/2018 5:00 PM”. Valid input for this parameter is from the start_date - now. Default is now. Optional
status A comma-separated list of message statuses by which to filter the results. Can be one of the following: GettingStatus (The message is waiting for status update), Failed (Message delivery was attempted and it failed or the message was filtered as spam or malware, or by transport rules), Pending (Message delivery is underway or was deferred and is being retried), Delivered (The message was delivered to its destination), Expanded (There was no message delivery because the message was addressed to a distribution group and the membership of the distribution was expanded), Quarantined (The message was quarantined), FilteredAsSpam (The message was marked as spam). Possible values are: GettingStatus, Failed, Pending, Delivered, Expanded, Quarantined, FilteredAsSpam. Optional
subject The subject parameter filters the results by the subject of the message. If the value contains spaces, enclose the value in quotation marks (“). Optional
subject_filter_type The subject_filter_type parameter specifies how the value of the subject parameter is evaluated. Valid values are: Contains, EndsWith, StartsWith. It is recommended to use StartsWith or EndsWith instead of Contains whenever possible. Optional
starting_recipient_address The starting_recipient_address parameter is used with the end_date parameter to query subsequent data while avoiding duplicates. For subsequent queries, use the Recipient address and Received Time from the last record of the previous results as the values for starting_recipient_address and end_date, respectively. Optional
limit The maximum number of results to return. A valid value is from 1 to 5000. The default value is 1000. Optional

Context Output

Path Type Description
EWS.MessageTrace.FromIP String The public IP address of the SMTP email server that sent the message.
EWS.MessageTrace.ToIP String The public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, the value is blank.
EWS.MessageTrace.MessageId String Message-ID header field of the message.
EWS.MessageTrace.MessageTraceId String Message trace ID of the message.
EWS.MessageTrace.Received Date Message receive time.
EWS.MessageTrace.RecipientAddress String Message recipients address.
EWS.MessageTrace.SenderAddress String Message sender address.
EWS.MessageTrace.Size Number Message size in bytes.
EWS.MessageTrace.Status String Message status.
EWS.MessageTrace.Subject String Message subject.

Command Example


#### Context Example

```json
{
"EWS": {
 "MessageTrace": [
            {
                "EndDate": "2021-01-03T06:14:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 1,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:45:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:14:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            },
            {
                "EndDate": "2021-01-03T06:15:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 2,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:46:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:15:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            }
        ]
    }
}

Human Readable Output

EWS extension - Messages trace

EndDate FromIP Index MessageId MessageTraceId Organization Received RecipientAddress SenderAddress Size StartDate Status Subject ToIP
1/3/2021 6:14:14 AM 8.8.8.8 0 xxx xxxx microsoft.com 1/3/2021 4:45:36 AM xsoar@dev.microsoft.com xsoar@dev.onmicrosoft.com 6975 1/1/2021 6:14:14 AM Delivered Test mail  
1/3/2021 6:15:14 AM 8.8.8.8 1 xxx xxxx microsoft.com 1/3/2021 4:46:36 AM xsoar@dev.microsoft.com xsoar@dev.onmicrosoft.com 6975 1/1/2021 6:15:14 AM Delivered Test mail  

ews-federation-trust-get

Displays the federation trust configured for the Exchange organization.

Base Command

ews-federation-trust-get

Input

Argument Name Description Required
domain_controller The domain controller identified by its fully qualified domain name (FQDN). For example, dc01.example.com. This argument is available only in on-premises Exchange. Optional
identity The federation trust ID. If not specified, the command returns all federation trusts configured for the Exchange organization. Optional

Context Output

Path Type Description
EWS.FederationTrust.AdminDisplayName String Administrator display name of the federation trust.
EWS.FederationTrust.ApplicationIdentifier String Application identifier of the federation trust.
EWS.FederationTrust.ApplicationUri String Application URI of the federation trust.
EWS.FederationTrust.DistinguishedName String Distinguished name of the federation trust.
EWS.FederationTrust.ExchangeObjectId String Exchange object ID of the federation trust.
EWS.FederationTrust.ExchangeVersion String Exchange version of the federation trust.
EWS.FederationTrust.Guid String GUID of the federation trust.
EWS.FederationTrust.Id String ID of the federation trust.
EWS.FederationTrust.Identity String Identity of the federation trust.
EWS.FederationTrust.IsValid Boolean Whether the federation trust is valid.
EWS.FederationTrust.MetadataEpr String Metadata EPR of the federation trust.
EWS.FederationTrust.MetadataPollInterval Date Metadata poll interval of the federation trust.
EWS.FederationTrust.MetadataPutEpr Unknown Metadata put EPR of the federation trust.
EWS.FederationTrust.Name String Name of the federation trust.
EWS.FederationTrust.NamespaceProvisioner String Namespace provisioner of the federation trust.
EWS.FederationTrust.ObjectCategory String Object category of the federation trust.
EWS.FederationTrust.ObjectClass String Object class of the federation trust.
EWS.FederationTrust.ObjectState String Object state of the federation trust.
EWS.FederationTrust.OrgCertificate.Archived Boolean Whether the organization certificate of the federation trust is archived.
EWS.FederationTrust.OrgCertificate.Extensions.Critical Boolean Whether the extensions of the organization certificate are critical.
EWS.FederationTrust.OrgCertificate.Extensions.Oid.FriendlyName String Friendly name of the OID of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.Oid.Value String Value of the OID of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.RawData Number Raw data of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.SubjectKeyIdentifier String Subject key identifier of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.KeyUsages Number Key usages of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.EnhancedKeyUsages.FriendlyName String Friendly name of the enhanced key usages of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.EnhancedKeyUsages.Value String Value of the enhanced key usages of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.Extensions.CertificateAuthority Boolean Whether the organization certificate extensions have a certificate authority.
EWS.FederationTrust.OrgCertificate.Extensions.HasPathLengthConstraint Boolean Whether the organization certificate extensions have a path length constraint.
EWS.FederationTrust.OrgCertificate.Extensions.PathLengthConstraint Number Path length constraint of the organization certificate extensions.
EWS.FederationTrust.OrgCertificate.FriendlyName String Friendly name of the organization certificate.
EWS.FederationTrust.OrgCertificate.Handle.value Number The handle value of the organization certificate.
EWS.FederationTrust.OrgCertificate.HasPrivateKey Boolean Whether the organization certificate has a private key.
EWS.FederationTrust.OrgCertificate.Issuer String Issuer of the organization certificate.
EWS.FederationTrust.OrgCertificate.IssuerName.Name String Name of the issuer of the organization certificate.
EWS.FederationTrust.OrgCertificate.IssuerName.Oid.FriendlyName Unknown Friendly name of the OID of the issuer name of the organization certificate.
EWS.FederationTrust.OrgCertificate.IssuerName.Oid.Value Unknown Value of the OID of the issuer name of the organization certificate.
EWS.FederationTrust.OrgCertificate.IssuerName.RawData Number Raw Data of the issuer name of the organization certificate.
EWS.FederationTrust.OrgCertificate.NotAfter Date The date until when the organization certificate is valid.
EWS.FederationTrust.OrgCertificate.NotBefore Date The date the organization certificate became valid.
EWS.FederationTrust.OrgCertificate.PrivateKey Unknown Private key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName String Friendly name of the OID of the encoded key value of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.Oid.Value String Value of the OID of the encoded key value of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.RawData Number Raw data of the encoded key value of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.Oid.FriendlyName String Friendly name of the OID of the encoded parameters of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.Oid.Value String Value of the OID of the encoded parameters of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.RawData Number Raw Data of the encoded parameters of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Key.KeyExchangeAlgorithm String Key exchange algorithm of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.MaxSize Number Maximum size of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.MinSize Number Minimum size of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.SkipSize Number SkiPSize of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Key.SignatureAlgorithm String Signature algorithm of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Oid.FriendlyName String Friendly name of the OID of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.PublicKey.Oid.Value String Value of the OID of the public key of the organization certificate.
EWS.FederationTrust.OrgCertificate.RawData Number Raw data of the organization certificate.
EWS.FederationTrust.OrgCertificate.SerialNumber String Serial number of the organization certificate.
EWS.FederationTrust.OrgCertificate.SignatureAlgorithm.FriendlyName String Friendly name of the signature algorithm of the organization certificate.
EWS.FederationTrust.OrgCertificate.SignatureAlgorithm.Value String Value of the signature algorithm of the organization certificate.
EWS.FederationTrust.OrgCertificate.Subject String Subject of the organization certificate.
EWS.FederationTrust.OrgCertificate.SubjectName.Name String Name of the subject of the organization certificate.
EWS.FederationTrust.OrgCertificate.SubjectName.Oid.FriendlyName Unknown Friendly name of the OID of the subject of the organization certificate.
EWS.FederationTrust.OrgCertificate.SubjectName.Oid.Value Unknown Value of the OID of the subject name of the organization certificate.
EWS.FederationTrust.OrgCertificate.SubjectName.RawData Number Raw data of the subject name of the organization certificate.
EWS.FederationTrust.OrgCertificate.Thumbprint String Thumbprint of the organization certificate.
EWS.FederationTrust.OrgCertificate.Version Number Version of the organization certificate.
EWS.FederationTrust.OrgNextCertificate Unknown Next organization certificate.
EWS.FederationTrust.OrgNextPrivCertificate String Next organization private certificate.
EWS.FederationTrust.OrgPrevCertificate.Archived Boolean Whether to archive the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.Extensions.Critical Boolean Whether the extensions of the previous organization certificate are critical.
EWS.FederationTrust.OrgPrevCertificate.Extensions.Oid.FriendlyName String Friendly name of the OID of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.Oid.Value String Value of the OID of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.RawData Number Raw data of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.SubjectKeyIdentifier String Subject key identifier of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.KeyUsages Number Key usages of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.EnhancedKeyUsages.FriendlyName String Friendly name of the enhanced key usages of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.Extensions.EnhancedKeyUsages.Value String Value of the enhanced key usages of the previous organization certificate extensions.
EWS.FederationTrust.OrgPrevCertificate.FriendlyName String Friendly name of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.Handle.value Number Value of the handle of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.HasPrivateKey Boolean Whether the previous organization certificate has a private key.
EWS.FederationTrust.OrgPrevCertificate.Issuer String Issuer of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.IssuerName.Name String Name of the issuer of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.IssuerName.Oid.FriendlyName Unknown Friendly name of the OID of the issuer of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.IssuerName.Oid.Value Unknown Value of the OID of the issuer of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.IssuerName.RawData Number Raw Data of the issuer of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.NotAfter Date The date until when the previous organization certificate is valid.
EWS.FederationTrust.OrgPrevCertificate.NotBefore Date The date the previous organization certificate became valid.
EWS.FederationTrust.OrgPrevCertificate.PrivateKey Unknown Private Key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName String Friendly name of the OID of the encoded key value of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.Oid.Value String Value of the OID of the encoded key value of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.RawData Number Raw data of the encoded key value of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.Oid.FriendlyName String Friendly name of the OID of the encoded parameters of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.Oid.Value String Value of the OID of the encoded parameters of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.RawData Number Raw data of the encoded parameters of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.KeyExchangeAlgorithm String Key exchange algorithm of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.MaxSize Number Maximum size of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.MinSize Number Minimum size of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.SkipSize Number SkiPSize of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.SignatureAlgorithm String Signature algorithm of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Oid.FriendlyName String Friendly Name of the OID of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.PublicKey.Oid.Value String Value of the OID of the public key of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.RawData Number Raw Data of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SerialNumber String Serial number of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SignatureAlgorithm.FriendlyName String Friendly name of the signature algorithm of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SignatureAlgorithm.Value String Value of the signature algorithm of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.Subject String Subject of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SubjectName.Name String Name of the subject of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SubjectName.Oid.FriendlyName Unknown Friendly name of the OID of the subject of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SubjectName.Oid.Value Unknown Value of the OID of the subject name of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.SubjectName.RawData Number Raw data of the subject name of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.Thumbprint String Thumbprint of the previous organization certificate.
EWS.FederationTrust.OrgPrevCertificate.Version Number Version of the previous organization certificate.
EWS.FederationTrust.OrgPrevPrivCertificate String Organization previous private certificate.
EWS.FederationTrust.OrgPrivCertificate String Organization private certificate.
EWS.FederationTrust.OrganizationId String Organization ID.
EWS.FederationTrust.OriginatingServer String Originating server.
EWS.FederationTrust.PSComputerName String PowerShell computer name.
EWS.FederationTrust.PSShowComputerName Boolean Whether to show the PowerShell computer name.
EWS.FederationTrust.PolicyReferenceUri String Policy Reference URI.
EWS.FederationTrust.RunspaceId String Runspace ID.
EWS.FederationTrust.TimesOfUnmatchPartner Number Times Of unmatch partner.
EWS.FederationTrust.TokenIssuerCertReference String Token issuer certificate reference.
EWS.FederationTrust.TokenIssuerCertificate.Archived Boolean Whether the token issuer certificate is archived.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.Critical Boolean Whether the extensions of the token issuer certificate are critical.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.Oid.FriendlyName String Friendly name of the OID of the extensions of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.Oid.Value String Value of the OID of the extensions of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.RawData Number Raw Data of the extensions of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.SubjectKeyIdentifier String Subject key identifier of the extensions of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Extensions.KeyUsages Number Key usages of the extensions of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.FriendlyName String Friendly name of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Handle.value Number Value of the handle of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.HasPrivateKey Boolean Whether the token issuer certificate has a private key.
EWS.FederationTrust.TokenIssuerCertificate.Issuer String Issuer of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Name String Name of the issuer of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Oid.FriendlyName Unknown Friendly name of the OID of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Oid.Value Unknown Value of the OID of the issuer of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.IssuerName.RawData Number Raw data of the issuer of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.NotAfter Date The date until when the token issuer certificate is valid.
EWS.FederationTrust.TokenIssuerCertificate.NotBefore Date The date the token issuer certificate became valid.
EWS.FederationTrust.TokenIssuerCertificate.PrivateKey Unknown Private key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName String Friendly name of the OID of the encoded key value of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.Oid.Value String Value of the OID of the encoded key value of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.RawData Number Raw data of the encoded key value of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.Oid.FriendlyName String Friendly name of the OID of the encoded parameters of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.Oid.Value String Value of the OID of the encoded parameters of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.RawData Number Raw Data of the encoded parameters of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.KeyExchangeAlgorithm String Key exchange algorithm of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.MaxSize Number Maximum size of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.MinSize Number Minimum size of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.SkipSize Number SkiPSize of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.SignatureAlgorithm String Signature algorithm of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Oid.FriendlyName String Friendly name of the OID of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Oid.Value String Value of the OID of the public key of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.RawData Number Raw Data of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SerialNumber String Serial number of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SignatureAlgorithm.FriendlyName String Friendly name of the signature algorithm of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SignatureAlgorithm.Value String Value of the signature algorithm of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Subject String Subject of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Name String Name of the subject of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Oid.FriendlyName Unknown Friendly name of the OID of the subject of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Oid.Value Unknown Value of the OID of the subject of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.SubjectName.RawData Number Raw data of the subject of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Thumbprint String Thumbprint of the token issuer certificate.
EWS.FederationTrust.TokenIssuerCertificate.Version Number Version of the token issuer certificate.
EWS.FederationTrust.TokenIssuerEpr String Token issuer EPR.
EWS.FederationTrust.TokenIssuerMetadataEpr String Token issuer metadata EPR.
EWS.FederationTrust.TokenIssuerPrevCertReference String Token issuer previous certificate reference.
EWS.FederationTrust.TokenIssuerPrevCertificate.Archived Boolean Whether the token issuer previous certificate was archived.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Critical Boolean Whether the extensions of the token issuer previous certificate was critical.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Oid.FriendlyName String Friendly name of the OID of the extensions of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Oid.Value String Value of the OID of the extensions of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.RawData Number Raw data of the extensions of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.SubjectKeyIdentifier String Subject key identifier of the extensions of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.KeyUsages Number Key usages of the extensions of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.FriendlyName String Friendly name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Handle.value Number The handle value of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.HasPrivateKey Boolean Whether the token issuer previous certificate has a private key.
EWS.FederationTrust.TokenIssuerPrevCertificate.Issuer String Issuer of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Name String Name of the issuer of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Oid.FriendlyName Unknown Friendly name of the OID of the issuer name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Oid.Value Unknown Value of the OID of the issuer name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.RawData Number Raw Data of the issuer name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.NotAfter Date The date until when the token issuer previous certificate is valid.
EWS.FederationTrust.TokenIssuerPrevCertificate.NotBefore Date The date the token issuer previous certificate became valid.
EWS.FederationTrust.TokenIssuerPrevCertificate.PrivateKey Unknown Private Key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName String Friendly name of the OID of the encoded key value of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.Oid.Value String Value of the OID of the encoded key value of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.RawData Number Raw data of the encoded key value of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.Oid.FriendlyName String Friendly name of the OID of the encoded parameters of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.Oid.Value String Value of the OID of the encoded parameters of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.RawData Number Raw data of the encoded parameters of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.KeyExchangeAlgorithm String Key exchange algorithm of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.MaxSize Number Maximum size of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.MinSize Number Minimum size of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.SkipSize Number SkiPSize of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.SignatureAlgorithm String Signature algorithm of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Oid.FriendlyName String Friendly Name of the OID of the public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Oid.Value String Value of the OID of teh public key of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.RawData Number Raw Data of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SerialNumber String Serial number of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SignatureAlgorithm.FriendlyName String Friendly name of the signature algorithm of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SignatureAlgorithm.Value String Value of the signature algorithm of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Subject String Subject of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Name String Name of the subject of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Oid.FriendlyName Unknown Friendly Name of the OID of the subject of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Oid.Value Unknown Value of the OID of the subject name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.RawData Number Raw data of the subject name of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Thumbprint String Thumbprint of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerPrevCertificate.Version Number Version of the token issuer previous certificate.
EWS.FederationTrust.TokenIssuerType String Token issuer type of the federation trust.
EWS.FederationTrust.TokenIssuerUri String Token Issuer UIR of the federation trust.
EWS.FederationTrust.WebRequestorRedirectEpr String Web requestor redirect EPR of the federation trust.
EWS.FederationTrust.WhenChanged Date The date the federation trust was changed.
EWS.FederationTrust.WhenChangedUTC Date The date in UTC format of when the federation trust was changed.
EWS.FederationTrust.WhenCreated Date The date the federation trust was created.
EWS.FederationTrust.WhenCreatedUTC Date The date in UTC format of when the federation trust was created.

ews-federation-configuration-get

Retrieves the Exchange organization’s federated organization identifier and related details, such as federated domains, organization contact, and status.

Base Command

ews-federation-configuration-get

Input

Argument Name Description Required
domain_controller The fully qualified domain name (FQDN) of the domain controller. For example, dc01.example.com. This argument is available only in on-premises Exchange. Optional
identity The federation trust ID. If not specified, all federation trusts configured for the Exchange organization are returned. Optional
include_extended_domain_info The IncludeExtendedDomainInfo switch specifies that the command query Microsoft Federation Gateway for the status of each accepted domain that’s federated. The status is returned with each domain in the Domains property. Possible values: “true” and “false”. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
EWS.FederationConfiguration.AccountNamespace String Account namespace of the federation configuration.
EWS.FederationConfiguration.DefaultDomain Unknown Default domain of the federation configuration.
EWS.FederationConfiguration.DelegationTrustLink String Delegation trust link of the federation configuration.
EWS.FederationConfiguration.DistinguishedName String Distinguished name of the federation configuration.
EWS.FederationConfiguration.Domains String Domains of the federation configuration.
EWS.FederationConfiguration.Enabled Boolean Whether the federation configuration is enabled.
EWS.FederationConfiguration.ExchangeObjectId String Exchange object ID of the federation configuration.
EWS.FederationConfiguration.ExchangeVersion String Exchange version of the federation configuration.
EWS.FederationConfiguration.Guid String GUID of the federation configuration.
EWS.FederationConfiguration.Id String ID of the federation configuration.
EWS.FederationConfiguration.Identity String Identity of the federation configuration.
EWS.FederationConfiguration.IsValid Boolean Whether the federation configration is valid.
EWS.FederationConfiguration.Name String Name of the federation configuration.
EWS.FederationConfiguration.ObjectCategory String Object category of the federation configuration.
EWS.FederationConfiguration.ObjectClass String Object class of the federation configuration.
EWS.FederationConfiguration.ObjectState String Object state of the federation configuration.
EWS.FederationConfiguration.OrganizationContact String Organization contact of the federation configuration.
EWS.FederationConfiguration.OrganizationId String Organization ID of the federation configuration.
EWS.FederationConfiguration.OriginatingServer String Originating server of the federation configuration.
EWS.FederationConfiguration.PSComputerName String PowerShell computer name of the federation configuration.
EWS.FederationConfiguration.PSShowComputerName Boolean Whether to show the PowerShell computer name of the federation configuration.
EWS.FederationConfiguration.RunspaceId String Runspace ID of the federation configuration.
EWS.FederationConfiguration.WhenChanged Date The date the federation configuration was changed.
EWS.FederationConfiguration.WhenChangedUTC Date The date in UTC format of when the federation configuration was changed.
EWS.FederationConfiguration.WhenCreated Date The date the federation configuration was created.
EWS.FederationConfiguration.WhenCreatedUTC Date The date in UTC format of when the federation configuration was created.

ews-remote-domain-get

Gets the configuration information for the remote domains configured in your organization. This command is available only in the Exchange Online PowerShell V3 module.

Base Command

ews-remote-domain-get

Input

Argument Name Description Required
domain_controller The fully qualified domain name (FQDN) of the domain controller. For example, dc01.example.com.
This argument is available only in on-premises Exchange.		 Optional
identity The remote domain that you want to view. You can use the GUID, ID, or any other identifier. Optional

Context Output

Path Type Description
EWS.RemoteDomain.AdminDisplayName String Admin display name of the remote domain.
EWS.RemoteDomain.AllowedOOFType String Allowed OOF type of the remote domain.
EWS.RemoteDomain.AutoForwardEnabled Boolean Whether auto forward is enabled for the remote domain.
EWS.RemoteDomain.AutoReplyEnabled Boolean Whether auto reply is enabled for the remote domain..
EWS.RemoteDomain.ByteEncoderTypeFor7BitCharsets String Byte encoder type For 7-bit charsets of the remote domain.
EWS.RemoteDomain.CharacterSet String Character set of the remote domain.
EWS.RemoteDomain.ContentType String Content type of the remote domain.
EWS.RemoteDomain.DeliveryReportEnabled Boolean Whether delivery report is enabled for the remote domain.
EWS.RemoteDomain.DisplaySenderName Boolean Whether to display the sender name for the remote domain.
EWS.RemoteDomain.DistinguishedName String Distinguished name of the remote domain.
EWS.RemoteDomain.DomainName String Domain name of the remote domain.
EWS.RemoteDomain.ExchangeObjectId String Exchange object ID of the remote domain.
EWS.RemoteDomain.ExchangeVersion String Exchange version of the remote domain.
EWS.RemoteDomain.Guid String GUID of the remote domain.
EWS.RemoteDomain.Id String ID of the remote domain.
EWS.RemoteDomain.Identity String Identity of the remote domain.
EWS.RemoteDomain.IsInternal Boolean Whether the remote domain is internal.
EWS.RemoteDomain.IsValid Boolean Whether the remote domain is valid.
EWS.RemoteDomain.LineWrapSize String Line wrap size for the remote domain.
EWS.RemoteDomain.MeetingForwardNotificationEnabled Boolean Whether meeting forward notification is enabled for the remote domain.
EWS.RemoteDomain.MessageCountThreshold Number Message count threshold of the remote domain.
EWS.RemoteDomain.NDRDiagnosticInfoEnabled Boolean Whether NDR diagnostic information is enabled for the remote domain.
EWS.RemoteDomain.NDREnabled Boolean Whether NDR is enabled for the remote domain.
EWS.RemoteDomain.Name String Name of the remote domain.
EWS.RemoteDomain.NonMimeCharacterSet String Non-mime character set of the remote domain.
EWS.RemoteDomain.ObjectCategory String Object category of the remote domain.
EWS.RemoteDomain.ObjectClass String Object class of the remote domain.
EWS.RemoteDomain.ObjectState String Object state of the remote domain.
EWS.RemoteDomain.OrganizationId String Organization ID of the remote domain.
EWS.RemoteDomain.OriginatingServer String Originating server of the remote domain.
EWS.RemoteDomain.PSComputerName String PowerShell computer name of the remote domain.
EWS.RemoteDomain.PSShowComputerName Boolean Whether to show the PowerShell computer name for the remote domain.
EWS.RemoteDomain.PreferredInternetCodePageForShiftJis String Preferred internet code page for shift JIS for the remote domain.
EWS.RemoteDomain.RequiredCharsetCoverage Unknown Required charset coverage for the remote domain.
EWS.RemoteDomain.RunspaceId String Runspace ID for the remote domain.
EWS.RemoteDomain.TNEFEnabled Unknown Whether TNEF is enabled for the remote domain.
EWS.RemoteDomain.TargetDeliveryDomain Boolean Whether the remote domain is used for the target email address of mail users that represent the users in the other forest.
EWS.RemoteDomain.TrustedMailInboundEnabled Boolean Whether inbound trusted mail is enabled.
EWS.RemoteDomain.TrustedMailOutboundEnabled Boolean Whether outbound trusted mail is enabled.
EWS.RemoteDomain.UseSimpleDisplayName Boolean Whether to use the simple display name.
EWS.RemoteDomain.WhenChanged Date The date the remote domain was changed.
EWS.RemoteDomain.WhenChangedUTC Date The date in UTC format of when the remote domain was changed.
EWS.RemoteDomain.WhenCreated Date The date the remote domain was created.
EWS.RemoteDomain.WhenCreatedUTC Date The date in UTC format of when the remote domain was created.

ews-user-list

Displays the existing user objects in your organization.

Base Command

ews-user-list

Input

Argument Name Description Required
identity The mailbox you want to view. Optional
organizational_unit The object’s location in Active Directory by which to filter the results. Optional
limit Maximum number of users to get. A value of 0 means to get all users. Default is 10. Optional

Context Output

Path Type Description
EWS.User.AccountDisabled Boolean Whether the user account is disabled.
EWS.User.AllowUMCallsFromNonUsers Boolean Whether to allow Unified Messaging calls from non-users.
EWS.User.ArchiveRelease String The archive release of the user object.
EWS.User.AssistantName String The assistant name of the user object.
EWS.User.AuthenticationPolicy Unknown The authentication policy of the user object.
EWS.User.CanHaveCloudCache Boolean Whether the user object can have cloud cache.
EWS.User.City String The city of the user object.
EWS.User.CloudCacheAccountType String Cloud cache account type of the user object.
EWS.User.CloudCacheProvider Number Cloud cache provider of the user object.
EWS.User.CloudCacheRemoteEmailAddress String Cloud cache remote email address of the user object.
EWS.User.CloudCacheScope Number Cloud cache scope of the user object.
EWS.User.CloudCacheUserName String Cloud cache user name of the user object.
EWS.User.Company String Company of the user object.
EWS.User.ConsumerNetID Unknown Consumer net ID of the user object.
EWS.User.CountryOrRegion String Country or region of the .
EWS.User.DefaultMailboxWorkloadsMask Unknown Default mailbox workloads mask of the user object.
EWS.User.Department String Department of the user object.
EWS.User.DesiredMailboxWorkloads Unknown Desired mailbox workloads of the user object.
EWS.User.DesiredMailboxWorkloadsGracePeriod Unknown Desired mailbox workloads grace period of the user object.
EWS.User.DesiredMailboxWorkloadsModified Unknown Modified desired mailbox workloads of the user object.
EWS.User.DisplayName String Display name of the user object.
EWS.User.DistinguishedName String Distinguished name of the user object.
EWS.User.ExchangeObjectId String Exchange object ID of the user object.
EWS.User.ExchangeVersion String Exchange version of the user object.
EWS.User.ExternalDirectoryObjectId String External Directory Object ID of the user object.
EWS.User.Fax String Fax of the user object.
EWS.User.FirstName String First name of the user object.
EWS.User.GeoCoordinates Unknown Geo coordinates of the user object.
EWS.User.Guid String GUID of the user object.
EWS.User.HomePhone String Home phone of the user object.
EWS.User.Id String ID of the user object.
EWS.User.Identity String Identity of the user object.
EWS.User.Initials String Initials of the user object.
EWS.User.IsCloudCache Boolean Whether there is a cloud cache for the user object.
EWS.User.IsCloudCacheBlocked Boolean Whether the cloud cache is blocked.
EWS.User.IsCloudCacheProvisioningComplete Boolean Whether cloud cache provisioning is complete.
EWS.User.IsDirSynced Boolean Whether the directory is synched.
EWS.User.IsInactiveMailbox Boolean Whether the mailbox is inactive.
EWS.User.IsLinked Boolean Whether the user object is linked.
EWS.User.IsSecurityPrincipal Boolean Whether there is a security principal.
EWS.User.IsSoftDeletedByDisable Boolean Whether soft delete is disabled and hard (permanent) delete occurs.
EWS.User.IsSoftDeletedByRemove Boolean When the Exchange Online mailbox is deleted (soft delete), this property is set to True.
EWS.User.IsValid Boolean Whether the user object is valid.
EWS.User.LastName String Last name of the user object.
EWS.User.LegacyExchangeDN String Legacy exchange distinguished name of the user object.
EWS.User.LegalAgeGroup Unknown Legal age group of the user object.
EWS.User.LinkedMasterAccount String Linked master account of the user object.
EWS.User.MailboxLocations String Mailbox locations of the user object.
EWS.User.MailboxProvisioningConstraint Unknown Mailbox provisioning constraint of the user object.
EWS.User.MailboxRegion Unknown Mailbox region of the user object.
EWS.User.MailboxRegionLastUpdateTime Unknown Last time the mailbox region of the user object was updated.
EWS.User.MailboxRegionSuffix String Mailbox region suffix of the user object.
EWS.User.MailboxRelease String Mailbox release of the user object.
EWS.User.MailboxWorkloads String Mailbox workloads of the user object.
EWS.User.Manager Unknown Manager of the user object.
EWS.User.MicrosoftOnlineServicesID String Microsoft Online Services ID of the user object.
EWS.User.MobilePhone String Mobile phone of the user object.
EWS.User.Name String Name of the user object.
EWS.User.NetID String Network ID of the user object.
EWS.User.Notes String Notes for the user object.
EWS.User.ObjectCategory String Object category of the user object.
EWS.User.ObjectClass String Object class of the user object.
EWS.User.ObjectState String Object state of the user object.
EWS.User.Office String Office of the user object.
EWS.User.OrganizationId String Organization ID of the user object.
EWS.User.OrganizationalUnit String Organizational unit of the user object.
EWS.User.OriginatingServer String Originating server of the user object.
EWS.User.PSComputerName String PowerShell computer name of the user object.
EWS.User.PSShowComputerName Boolean Whether to show the PowerShell computer name of the user object.
EWS.User.Pager String Pager of the user object.
EWS.User.Phone String Phone of the user object.
EWS.User.PhoneticDisplayName String Phonetic display name of the user object.
EWS.User.PostalCode String Postal Code of the user object.
EWS.User.PreviousRecipientTypeDetails String Details of the previous recipient type of the user object.
EWS.User.RecipientType String Recipient type of the user object.
EWS.User.RecipientTypeDetails String Details of the recipient type of the user object.
EWS.User.RemotePowerShellEnabled Boolean Whether remote PowerShell is enabled for the user object.
EWS.User.ResetPasswordOnNextLogon Boolean Whether to reset the password on next logon.
EWS.User.RunspaceId String Runspace ID of the user object.
EWS.User.SKUAssigned Boolean Whether SKU is assigned.
EWS.User.SamAccountName String sAMAccountName of the user object.
EWS.User.SeniorityIndex Unknown Seniority index of the user object.
EWS.User.Sid String SID of the user object.
EWS.User.SimpleDisplayName String Simple display name of the user object.
EWS.User.StateOrProvince String State or province of the user object.
EWS.User.StreetAddress String Street address of the user object.
EWS.User.StsRefreshTokensValidFrom Date The validation start date for the Security Token Service (STS) refresh tokens of the user object.
EWS.User.TelephoneAssistant String Telephone assistant of the user object.
EWS.User.Title String Title of the user object.
EWS.User.UMDialPlan Unknown Unified Messaging (UM) dial plan of the user object.
EWS.User.UMDtmfMap String Unified Messaging (UM) dual tone multi-frequency (DTMF) map of the user object.
EWS.User.UpgradeDetails Unknown Upgrade details of the user object.
EWS.User.UpgradeMessage Unknown Upgrade message of the user object.
EWS.User.UpgradeRequest String Upgrade request of the user object.
EWS.User.UpgradeStage Unknown Upgrade stage of the user object.
EWS.User.UpgradeStageTimeStamp Unknown Upgrade stage time stamp of the user object.
EWS.User.UpgradeStatus String Upgrade status of the user object.
EWS.User.UserAccountControl String User account control of the user object.
EWS.User.UserPrincipalName String User principal name of the user object.
EWS.User.WebPage String Web page of the user object.
EWS.User.WhenChanged Date The date the user object was changed.
EWS.User.WhenChangedUTC Date The date in UTC format of when the user object was changed.
EWS.User.WhenCreated Date The date the user object was created.
EWS.User.WhenCreatedUTC Date The date in UTC format of when the user object was created.
EWS.User.WhenSoftDeleted Unknown When the user object was soft deleted.
EWS.User.WindowsEmailAddress String Windows email address of the user object.
EWS.User.WindowsLiveID String Windows live ID of the user object.
EWS.User.DirectReports String Direct reports of the user object.

ews-mailbox-audit-bypass-association-list

Retrieves information about the AuditBypassEnabled property value for user accounts (on-premises Exchange and the cloud) and computer accounts (on-premises Exchange only).

Base Command

ews-mailbox-audit-bypass-association-list

Input

Argument Name Description Required
identity The mailbox you want to view. Optional
domain_controller The domain controller that’s used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN). This argument is available only in on-premises Exchange. Optional
limit Maximum number of users to get. A value of 0 means to get all users. Default is 10. Optional

Context Output

Path Type Description
EWS.MailboxAuditBypassAssociation.AuditBypassEnabled Boolean Whether the mailbox audit bypass association is enabled.
EWS.MailboxAuditBypassAssociation.DistinguishedName String Distinguished name of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ExchangeObjectId String Exchange object ID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ExchangeVersion String The version of the exchanged server.
EWS.MailboxAuditBypassAssociation.Guid String The GUID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.Id String ID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.Identity String The unique identity of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.IsValid Boolean Whether the mailbox audit bypass association property is enabled.
EWS.MailboxAuditBypassAssociation.Name String Name of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ObjectCategory String Object category of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ObjectClass String Object class of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ObjectId String Object ID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.ObjectState String Object state of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.OrganizationId String Organization ID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.OriginatingServer String Originating server of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.PSComputerName String PowerShell computer name of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.PSShowComputerName Boolean Whether to show the computer name of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.RunspaceId String Runspace ID of the mailbox audit bypass association.
EWS.MailboxAuditBypassAssociation.WhenChanged unknown The date the mailbox audit bypass association was changed.
EWS.MailboxAuditBypassAssociation.WhenChangedUTC Date The date in UTC of when the mailbox audit bypass association was changed.
EWS.MailboxAuditBypassAssociation.WhenCreated Date The date the mailbox audit bypass association was created.
EWS.MailboxAuditBypassAssociation.WhenCreatedUTC Date The date in UTC format of when the mailbox audit bypass association was created.

ews-rule-list

Get a list of all mailbox rules.

Base Command

ews-rule-list

Input

Argument Name Description Required
mailbox The mailbox that contains the Inbox rule. Required
limit Maximum number of rules to get. A value of 0 means to get all rules Optional

Context Output

Path Type Description
EWS.Rule.RuleIdentity String The rule identity.
EWS.Rule.Name String The rule name.
EWS.Rule.Enabled Boolean Whether the rule is enabled or not.
EWS.Rule.Priority String the rule priority.

Human Readable Output

Results of ews-rule-list

Enabled Name Priority RuleIdentity
true CheckActionRequired 1 1268829516541722625
true ews phishing test 8 1845290268845146113

ews-get-rule

Get a mailbox rule.

Base Command

ews-get-rule

Input

Argument Name Description Required
mailbox The mailbox that contains the Inbox rule. Required
identity The ID of the rule. Required

Context Output

Path Type Description
EWS.Rule.Rule String The rule identity.
EWS.Rule.RuleName String The rule name.
EWS.Rule.IsEnabled Boolean Whether the rule is enabled or not.
EWS.Rule.Priority String The rule priority.
EWS.Rule.Description String The description of the rule.
EWS.Rule.StopProcessingRules Boolean Whether to stop processing the rule or not.
EWS.Rule.IsValid Boolean Whether the rule is valid or not.

Human Readable Output

Results of ews-rule-list

Enabled Name Priority RuleIdentity Description IsValid StopProcessingRules
true CheckActionRequired 1 1268829516541722625 If the message: the sender requested any action and my name is in the To box true false

ews-remove-rule

Remove a mailbox rule.

Base Command

ews-remove-rule

Input

Argument Name Description Required
mailbox The mailbox that contains the Inbox rule. Required
identity The ID of the rule. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been deleted successfully

ews-rule-disable

Disable an existing inbox rule in a given mailbox.

Base Command

ews-rule-disable

Input

Argument Name Description Required
mailbox The mailbox that contains the inbox rule. Required
identity The inbox rule that you want to disable. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been disabled successfully

ews-rule-enable

Enable an existing inbox rule in a given mailbox.

Base Command

ews-rule-enable

Input

Argument Name Description Required
mailbox The mailbox that contains the inbox rule. Required
identity The inbox rule that you want to enable. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been enabled successfully

ews-mail-flow-rules-list

List all mail flow rules (transport rules) in the organization.

Base Command

ews-mail-flow-rules-list

Input

Argument Name Description Required
extended_output Determine whether the output will be in verbose format or not. Optional
limit The amount of mail flow rules to return. Optional

Context Output

Path Type Description
EWS.MailFlowRule.Size Number The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
EWS.MailFlowRule.ExpiryDate Date The date and time when the mail flow rule is set to expire and no longer apply.
EWS.MailFlowRule.Mode String The operational mode of the rule, indicating whether it is active (Enforce), in testing mode (Test), or disabled.
EWS.MailFlowRule.Quarantine Boolean Specifies whether the rule actions include quarantining messages that match the rule.
EWS.MailFlowRule.Guid String The unique identifier (Globally Unique Identifier) for the mail flow rule.
EWS.MailFlowRule.OrganizationId String The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
EWS.MailFlowRule.DistinguishedName String The distinguished name of the mail flow rule in the Exchange directory structure.
EWS.MailFlowRule.IsValid Boolean Indicates whether the mail flow rule is valid and functional.
EWS.MailFlowRule.Conditions Array The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
EWS.MailFlowRule.Comments Unknown Free-form text field for adding comments or notes about the rule, typically used for documentation.
EWS.MailFlowRule.WhenChanged Date The date and time when the mail flow rule was last modified.
EWS.MailFlowRule.Description String A brief description of the mail flow rule’s purpose or functionality.
EWS.MailFlowRule.Actions Array The actions taken when a message matches the rule’s conditions, such as redirecting, blocking, or adding headers.
EWS.MailFlowRule.ImmutableId String A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
EWS.MailFlowRule.Identity String The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
EWS.MailFlowRule.Name String The user-friendly name of the mail flow rule, typically used for easy identification.
EWS.MailFlowRule.CreatedBy String The user or process that created the mail flow rule.
EWS.MailFlowRule.RouteMessageOutboundConnector Unknown Specifies whether messages matching the rule should be routed through a specific outbound connector.

Human Readable Output

Results of ews-rule-list

Name State Priority Comment WhenChanged CreatedBy
demisto Disabled 1 comment 2019-10-14T07:25:04+00:00 Ed Testmaner
demisto-2 Enabled 2 comment 2019-11-15T010:21:45+00:00 Kemp Kimmons
demisto-3 Enabled 3 comment 2019-11-16T016:26:46+00:00 Barbara Wagner

ews-mail-flow-rule-get

Get a mail flow rule (transport rules) in the organization.

Base Command

ews-mail-flow-rule-get

Input

Argument Name Description Required
extended_output Determine whether the output will be in verbose format or not. Optional
identity Specifies the rule that you want to view. Optional

Context Output

Path Type Description
EWS.MailFlowRule.Size Number The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
EWS.MailFlowRule.ExpiryDate Date The date and time when the mail flow rule is set to expire and no longer apply.
EWS.MailFlowRule.Mode String The operational mode of the rule, indicating whether it is active (Enforce), in testing mode (Test), or disabled.
EWS.MailFlowRule.Quarantine Boolean Specifies whether the rule actions include quarantining messages that match the rule.
EWS.MailFlowRule.Guid String The unique identifier (Globally Unique Identifier) for the mail flow rule.
EWS.MailFlowRule.OrganizationId String The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
EWS.MailFlowRule.DistinguishedName String The distinguished name of the mail flow rule in the Exchange directory structure.
EWS.MailFlowRule.IsValid Boolean Indicates whether the mail flow rule is valid and functional.
EWS.MailFlowRule.Conditions Array The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
EWS.MailFlowRule.Comments Unknown Free-form text field for adding comments or notes about the rule, typically used for documentation.
EWS.MailFlowRule.WhenChanged Date The date and time when the mail flow rule was last modified.
EWS.MailFlowRule.Description String A brief description of the mail flow rule’s purpose or functionality.
EWS.MailFlowRule.Actions Array The actions taken when a message matches the rule’s conditions, such as redirecting, blocking, or adding headers.
EWS.MailFlowRule.ImmutableId String A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
EWS.MailFlowRule.Identity String The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
EWS.MailFlowRule.Name String The user-friendly name of the mail flow rule, typically used for easy identification.
EWS.MailFlowRule.CreatedBy String The user or process that created the mail flow rule.
EWS.MailFlowRule.RouteMessageOutboundConnector Unknown Specifies whether messages matching the rule should be routed through a specific outbound connector.

Human Readable Output

Results of ews-rule-list

Name State Priority Comment WhenChanged CreatedBy
demisto Disabled 1 comment 2019-10-14T07:25:04+00:00 Ed Testmaner

ews-mail-flow-rule-remove

Remove a mail flow rule (transport rule) from the organization.

Base Command

ews-mail-flow-rule-remove

Input

Argument Name Description Required
identity The rule that you want to remove. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been removed successfully

ews-mail-flow-rule-disable

Disable a mail flow rule (transport rule) in the organization.

Base Command

ews-mail-flow-rule-disable

Input

Argument Name Description Required
identity The rule that you want to disable. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been disabled successfully

ews-mail-flow-rule-enable

Enable a mail flow rule (transport rule) in the organization.

Base Command

ews-mail-flow-rule-enable

Input

Argument Name Description Required
identity The rule that you want to enable. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been enabled successfully

ews-mail-flow-rule-create

Create a transport rule (mail flow rule) in the organization. A name must always be provided, either through the name argument or as a Name key inside the entry_id file. When no entry_id file is provided, both the name argument and at least one action (reject_message_reason_text, quarantine, or delete_message) are required.

Base Command

ews-mail-flow-rule-create

Input

Argument Name Description Required
name The unique name of the rule. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks (“). A name must always be provided, either through this argument or as a Name key inside the entry_id file. If both are provided, the value from the entry_id file takes precedence. Optional
mode How the rule operates. Possible values are: Audit, AuditAndNotify, Enforce. Optional
priority The priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can’t have the same priority value. Optional
from A comma-separated list of senders to look for in messages. You can use any value that uniquely identifies the sender, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks (“). For example, to search for a sender with the name Chris and the alias Tech Writer, use the following syntax: Chris,”Tech Writer”. Optional
sent_to A comma-separated list of recipients to look for in messages. You can use any value that uniquely identifies the recipient, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks (“). For example, to search for a recipient with the name Chris and the alias Tech Writer, use the following syntax: Chris,”Tech Writer”. Optional
subject_contains_words A comma-separated list of words or phrases to look for in the Subject field of messages. If a value contains spaces, as with a phrase, enclose it in quotation marks (“). For example: Word1,”Phrase with spaces”,word2. Optional
except_if_subject_contains_words A comma-separated list of words or phrases that, when found in the Subject field of messages, exempt the message from the rule. If a value contains spaces, as with a phrase, enclose it in quotation marks (“). For example: Word1,”Phrase with spaces”,word2. Optional
reject_message_reason_text The explanation text that’s used when the rule rejects messages. If the value contains spaces, enclose the value in quotation marks (“). When no entry_id file is provided, at least one of the actions (reject_message_reason_text, quarantine, or delete_message) must be provided. Optional
quarantine Whether to quarantine messages that match the rule. When no entry_id file is provided, at least one of the actions (reject_message_reason_text, quarantine, or delete_message) must be provided. Possible values are: true, false. Optional
delete_message Whether to silently drop messages without an NDR. When no entry_id file is provided, at least one of the actions (reject_message_reason_text, quarantine, or delete_message) must be provided. Possible values are: true, false. Optional
comments The descriptive text for the rule (for example, what the rule is used for, or how it has changed over time). Optional
entry_id The War Room entry ID of a JSON file that contains additional rule parameters as a map of parameter name to value (for example, {“Name”: “My rule”, “ActivationDate”: “09/01/2018”}). Use this to set parameters that are not exposed as dedicated command arguments. Values in the file take precedence over the corresponding command arguments. If the name argument is not provided, the file must include a Name key. Optional
extended_output Whether the output will be in verbose format. Possible values are: true, false. Optional

Context Output

Path Type Description
EWS.MailFlowRule.Size Number The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
EWS.MailFlowRule.ExpiryDate Date The date and time when the mail flow rule is set to expire and no longer apply (e.g., 2024-01-15T12:34:56Z).
EWS.MailFlowRule.Mode String The operational mode of the rule, indicating whether it is active (Enforce), in testing mode (Test), or disabled.
EWS.MailFlowRule.Quarantine Boolean Specifies whether the rule actions include quarantining messages that match the rule.
EWS.MailFlowRule.Guid String The Globally Unique Identifier for the mail flow rule.
EWS.MailFlowRule.OrganizationId String The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
EWS.MailFlowRule.DistinguishedName String The distinguished name of the mail flow rule in the Exchange directory structure.
EWS.MailFlowRule.IsValid Boolean Indicates whether the mail flow rule is valid and functional.
EWS.MailFlowRule.Conditions Unknown The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
EWS.MailFlowRule.Comments Unknown Free-form text field for adding comments or notes about the rule, typically used for documentation.
EWS.MailFlowRule.WhenChanged Date The date and time when the mail flow rule was last modified (e.g., 2024-01-15T12:34:56Z).
EWS.MailFlowRule.Description String A brief description of the mail flow rule’s purpose or functionality.
EWS.MailFlowRule.Actions Unknown The actions taken when a message matches the rule’s conditions, such as redirecting, blocking, or adding headers.
EWS.MailFlowRule.ImmutableId Unknown A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
EWS.MailFlowRule.Identity String The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
EWS.MailFlowRule.Name String The user-friendly name of the mail flow rule, typically used for easy identification.
EWS.MailFlowRule.CreatedBy String The user or process that created the mail flow rule.
EWS.MailFlowRule.RouteMessageOutboundConnector Unknown Specifies whether messages matching the rule should be routed through a specific outbound connector.

Command example

!ews-mail-flow-rule-create name="My Rule" mode=Enforce priority=0 subject_contains_words="confidential" quarantine=true comments="Created by playbook"

Human Readable Output

Mail flow rule ‘My Rule’ was created successfully

Name State Mode Priority IsRuleConfigurationSupported Comments
My Rule Enabled Enforce 0 true Created by playbook

ews-mail-flow-rule-update

Modify an existing transport rule (mail flow rule) in the organization. An identity must always be provided, either through the identity argument or as an Identity key inside the entry_id file. When no entry_id file is provided, the identity argument is required.

Base Command

ews-mail-flow-rule-update

Input

Argument Name Description Required
identity The rule that you want to modify. You can use any value that uniquely identifies the rule, such as a name, distinguished name, or GUID. An identity must always be provided, either through this argument or as an Identity key inside the entry_id file. If both are provided, the value from the entry_id file takes precedence. Optional
mode How the rule operates. Possible values are: Audit, AuditAndNotify, Enforce. Optional
priority The priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can’t have the same priority value. Optional
from A comma-separated list of senders to look for in messages. You can use any value that uniquely identifies the sender, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks (“). For example, to search for a sender with the name Chris and the alias Tech Writer, use the following syntax: Chris,”Tech Writer”. Optional
sent_to A comma-separated list of recipients to look for in messages. You can use any value that uniquely identifies the recipient, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks (“). For example, to search for a recipient with the name Chris and the alias Tech Writer, use the following syntax: Chris,”Tech Writer”. Optional
subject_contains_words A comma-separated list of words or phrases to look for in the Subject field of messages. If a value contains spaces, as with a phrase, enclose it in quotation marks (“). For example: Word1,”Phrase with spaces”,word2. Optional
except_if_subject_contains_words A comma-separated list of words or phrases that, when found in the Subject field of messages, exempt the message from the rule. If a value contains spaces, as with a phrase, enclose it in quotation marks (“). For example: Word1,”Phrase with spaces”,word2. Optional
reject_message_reason_text The explanation text that’s used when the rule rejects messages. If the value contains spaces, enclose the value in quotation marks (“). Optional
quarantine Whether to quarantine messages that match the rule. Possible values are: true, false. Optional
delete_message Whether to silently drop messages without an NDR. Possible values are: true, false. Optional
comments The descriptive text for the rule (for example, what the rule is used for, or how it has changed over time). Optional
entry_id The War Room entry ID of a JSON file that contains additional rule parameters as a map of parameter name to value (for example, {“Identity”: “My rule”, “ActivationDate”: “09/01/2018”}). Use this to set parameters that are not exposed as dedicated command arguments. Values in the file take precedence over the corresponding command arguments. If the identity argument is not provided, the file must include an Identity key. Optional

Context Output

There are no context outputs for this command.

Command example

!ews-mail-flow-rule-update identity="My Rule" priority=1 comments="Updated by playbook"

Human Readable Output

Mail flow rule 1845290268845146113 has been updated successfully

ews-mail-forwarding-disable

Disable mail forwarding for a given user.

Base Command

ews-mail-forwarding-disable

Input

Argument Name Description Required
identity The mailbox that you want to modify. Required

Context Output

There are no context outputs for this command.

Human Readable Output

Mail forwarding for user 1845290268845146113 has been disabled successfully

```

Configuration parameters

  • url — Exchange Online URL (required)
  • certificate — (required)
  • password — (required)
  • organization — The organization used in app-only authentication. (required)
  • app_id — The application ID from the Azure portal (required)

Commands (37)

  • ews-cas-mailbox-list

    Displays Client Access settings that are configured on mailboxes.

  • ews-email-security-block-sender-office-365-quick-action

    Add new items to the Tenant Allow/Block Lists. Uses PowerShell New-TenantAllowBlockListItems cmdlet.

  • ews-email-security-unblock-sender-office-365-quick-action

    Remove items from the Tenant's Allow/Block Lists. You can delete items by their value or by their unique ID. Uses the PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.

  • ews-export-quarantinemessage

    Export quarantine messages. Uses PowerShell Export-QuarantineMessage cmdlet.

  • ews-federation-configuration-get

    Retrieves the Exchange organization's federated organization identifier and related details, such as federated domains, organization contact, and status.

  • ews-federation-trust-get

    Displays the federation trust configured for the Exchange organization.

  • ews-get-quarantinemessage

    Retrieve quarantine messages. Uses PowerShell Get-QuarantineMessage cmdlet.

  • ews-get-rule

    Retrieve information about the Inbox rule properties.

  • ews-get-tenant-allow-block-list-count

    Retrieve current count of defined Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

  • ews-get-tenant-allow-block-list-items

    Retrieve current Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

  • ews-global-junk-rules-set

    Sets junk rules in all managed accounts.

  • ews-junk-rules-get

    Gets junk rules for the specified mailbox.

  • ews-junk-rules-set

    Sets junk rules for the specified mailbox.

  • ews-mail-flow-rule-create

    Create a transport rule (mail flow rule) in the organization. A name must always be provided, either through the `name` argument or as a `Name` key inside the entry_id file. When no entry_id file is provided, both the `name` argument and at least one action (`reject_message_reason_text`, `quarantine`, or `delete_message`) are required.

  • ews-mail-flow-rule-disable

    Disable a mail flow rule (transport rule) in the organization.

  • ews-mail-flow-rule-enable

    Enable a mail flow rule (transport rule) in the organization.

  • ews-mail-flow-rule-get

    Get a mail flow rule (transport rules) in the organization.

  • ews-mail-flow-rule-remove

    Remove a mail flow rule (transport rule) from the organization.

  • ews-mail-flow-rule-update

    Modify an existing transport rule (mail flow rule) in the organization. An identity must always be provided, either through the `identity` argument or as an `Identity` key inside the entry_id file. When no entry_id file is provided, the `identity` argument is required.

  • ews-mail-flow-rules-list

    List all mail flow rules (transport rules) in the organization.

  • ews-mail-forwarding-disable

    Disable mail forwarding for a given user.

  • ews-mailbox-audit-bypass-association-list

    Retrieves information about the AuditBypassEnabled property value for user accounts (on-premises Exchange and the cloud) and computer accounts (on-premises Exchange only).

  • ews-mailbox-list

    Displays mailbox objects and attributes, populate property pages, or supplies mailbox information to other tasks.

  • ews-mailbox-permission-list

    Retrieves permissions on a mailbox.

  • ews-message-trace-get Deprecated

    (Deprecated) Searches message data for the last 10 days. If you run this command without any arguments, only data from the last 48 hours is returned. If you enter a start date that is older than 10 days, you will receive an error and the command will return no results. This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.

  • ews-message-trace-list

    Searches message data from the last 90 days. If you run this command without any arguments, only data from the last 48 hours is returned. If you enter a start date that is older than 90 days, you will receive an error and the command will return no results. This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.

  • ews-new-tenant-allow-block-list-items

    Add new items to the Tenant Allow/Block Lists. Uses PowerShell New-TenantAllowBlockListItems cmdlet.

  • ews-recipient-list

    Displays existing recipient objects in your organization. This command returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).

  • ews-recipient-permission-list

    Displays information about SendAs permissions that are configured for users.

  • ews-release-quarantinemessage

    Releases the quarantined messages. Uses the PowerShell Release-QuarantineMessage cmdlet.

  • ews-remote-domain-get

    Gets the configuration information for the remote domains configured in your organization. This command is available only in the Exchange Online PowerShell V2 module.

  • ews-remove-rule

    Remove an Inbox rule.

  • ews-remove-tenant-allow-block-list-items

    Remove items from the tenant's Allow/Block Lists. You can delete items by their value or by their unique ID. Uses the PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.

  • ews-rule-disable

    Disable an existing inbox rule in a given mailbox.

  • ews-rule-enable

    Enable an existing inbox rule in a given mailbox.

  • ews-rule-list

    Retrieve a list of an Inbox rules.

  • ews-user-list

    Displays the existing user objects in your organization.

Source

EwsExtensionEXOPowershellV3.Tests.ps1 EwsExtensionEXOPowershellV3.ps1 EwsExtensionEXOPowershellV3.yml EwsExtensionEXOPowershellV3_description.md command_examples.txt
Download History Raw 
category: Email
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: EWS Extension Online Powershell v3
  version: -1
configuration:
- defaultvalue: https://outlook.office365.com
  display: Exchange Online URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: Certificate
  name: certificate
  type: 9
  required: true
  additionalinfo: A pfx certificate encoded in Base64.
  hiddenusername: true
  section: Connect
- displaypassword: Password
  name: password
  required: true
  type: 9
  hiddenusername: true
  section: Connect
- display: The organization used in app-only authentication.
  name: organization
  required: true
  type: 0
  section: Connect
- display: The application ID from the Azure portal
  name: app_id
  required: true
  type: 0
  section: Connect
description: Use the EWS Extension Online Powershell v3 integration to get information about mailboxes and users in your organization.  This integration can also retrieve and modify Tenant Allow/Block Lists.
display: EWS Extension Online Powershell v3
name: EWS Extension Online Powershell v3
script:
  commands:
  - arguments:
    - name: identity
      description: The identity of the mailbox you want to view.
    - isArray: true
      name: property_sets
      description: 'A comma-separated list of property sets to fetch. These property sets will supplement the outputs of this integration.  Available properties are: "All", "Minimum", "AddressList", "Archive", "Audit", "Delivery", "Hold", "Moderation", "Move", "Policy", "PublicFolder", "Quota", "Resource", "Retention", "SCL", "SoftDelete", "StatisticsSeed".'
      defaultValue: Minimum
    - description: The object's location in Active Directory by which to filter the results.
      name: organizational_unit
    - description: The primary SMTP email address of the mailbox you want to view. Cannot be used with the user_principal_name argument. Can be retrieved using the ews-user-list command.
      name: primary_smtp_address
    - description: The UPN of the mailbox you want to view. Cannot be used with the primary_smtp_address argument. Can be retrieved using the ews-user-list command.
      name: user_principal_name
    - description: The maximum number of results to retrieve. Default is 10.
      name: limit
      defaultValue: '10'
    outputs:
    - contextPath: EWS.Mailbox.EmailAddresses
      description: Email addresses of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.AuditBypassEnabled
      description: Whether audit bypass is enabled.
      type: Boolean
    - contextPath: EWS.Mailbox.DistinguishedName
      description: Distinguished name of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ExchangeObjectId
      description: Exchange object ID of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ExchangeVersion
      description: Exchange version of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.Guid
      description: GUID of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.Id
      description: ID of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.Identity
      description: Identity of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.IsValid
      description: Whether the mailbox is valid.
      type: Boolean
    - contextPath: EWS.Mailbox.Name
      description: Name of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ObjectCategory
      description: Object category of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ObjectClass
      description: Object class of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ObjectId
      description: Object ID of the of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.ObjectState
      description: Object state of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.OrganizationId
      description: Organization ID of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.OriginatingServer
      description: Originating server of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.PSComputerName
      description: PowerShell computer name of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.PSShowComputerName
      description: PowerShell show computer name of the mailbox.
      type: Boolean
    - contextPath: EWS.Mailbox.RunspaceId
      description: Run space ID of the mailbox.
      type: String
    - contextPath: EWS.Mailbox.WhenChanged
      description: Local time of when the mailbox was last changed.
      type: Date
    - contextPath: EWS.Mailbox.WhenChangedUTC
      description: UTC time of when the mailbox was last changed.
      type: Date
    - contextPath: EWS.Mailbox.WhenCreated
      description: Local time of when the mailbox was created.
      type: Date
    - contextPath: EWS.Mailbox.WhenCreatedUTC
      description: UTC time of when the mailbox was created.
      type: Date
    description: Displays mailbox objects and attributes, populate property pages, or supplies mailbox information to other tasks.
    name: ews-mailbox-list
  - arguments:
    - name: identity
      description: The identity of the mailbox you want to view.
    - description: The object's location in Active Directory by which to filter the results.
      name: organizational_unit
    - description: The primary SMTP email address of the mailbox you want to view. Cannot be used with the user_principal_name argument. Can be retrieved using the ews-user-list command.
      name: primary_smtp_address
    - description: The UPN of the mailbox you want to view. Cannot be used with the primary_smtp_address argument. Can be retrieved using the ews-user-list command.
      name: user_principal_name
    - description: The maximum number of results to retrieve. Default is 10.
      name: limit
      defaultValue: '10'
    outputs:
    - contextPath: EWS.CASMailbox.ActiveSyncEnabled
      description: Whether active sync is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.DisplayName
      description: The display name of the mailbox.
      type: String
    - contextPath: EWS.CASMailbox.ECPEnabled
      description: Whether the Exchange Control Panel (ECP) is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.EmailAddresses
      description: The email addresses retrieved.
      type: String
    - contextPath: EWS.CASMailbox.EwsEnabled
      description: Whether the Exchange Web Services (EWS) is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.ExchangeVersion
      description: Exchange version of the client access server mailbox.
      type: String
    - contextPath: EWS.CASMailbox.ExternalDirectoryObjectId
      description: External directory object ID of the client access server mailbox.
      type: String
    - contextPath: EWS.CASMailbox.Guid
      description: The GUID of the client access server mailbox.
      type: String
    - contextPath: EWS.CASMailbox.Identity
      description: Identity of the client access server mailbox.
      type: String
    - contextPath: EWS.CASMailbox.ImapEnabled
      description: Whether the Internet Message Access Protocol (IMAP) is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.MAPIEnabled
      description: Whether the Messaging Application Programming Interface is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.Name
      description: Name of the client access server mailbox.
      type: String
    - contextPath: EWS.CASMailbox.OWAEnabled
      description: Whether Outlook on the web (OWA) is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.OrganizationId
      description: Organization ID.
      type: String
    - contextPath: EWS.CASMailbox.PopEnabled
      description: Whether Post Office Protocol (POP) is enabled.
      type: Boolean
    - contextPath: EWS.CASMailbox.PrimarySmtpAddress
      description: Primary SMTP address.
      type: String
    - contextPath: EWS.CASMailbox.ServerLegacyDN
      description: Server legacy distinguished name (DN).
      type: String
    description: Displays Client Access settings that are configured on mailboxes.
    name: ews-cas-mailbox-list
  - arguments:
    - description: The identity of the mailbox you want to view.
      name: identity
      required: true
    outputs:
    - contextPath: EWS.MailboxPermission.Identity
      description: The specified identity of the mailbox.
      type: String
    - contextPath: EWS.MailboxPermission.Permission.AccessRights
      description: Access rights of the mailbox.
      type: String
    - contextPath: EWS.MailboxPermission.Permission.Deny.IsPresent
      description: Whether permission is denied.
      type: Boolean
    - contextPath: EWS.MailboxPermission.Permission.Identity
      description: The permission identity.
      type: String
    - contextPath: EWS.MailboxPermission.Permission.InheritanceType
      description: Permission inheritance type.
      type: String
    - contextPath: EWS.MailboxPermission.Permission.IsInherited
      description: Whether permission is inherited.
      type: Boolean
    - contextPath: EWS.MailboxPermission.Permission.User
      description: The permission of the user.
      type: String
    description: Retrieves permissions on a mailbox.
    name: ews-mailbox-permission-list
  - arguments:
    - description: The identity of the mailbox you want to view.
      name: identity
    - description: The maximum number of results to retrieve. Default is 10.
      name: limit
      defaultValue: '10'
    outputs:
    - contextPath: EWS.RecipientPermission.AccessControlType
      description: Access control type of the recipient permission.
      type: String
    - contextPath: EWS.RecipientPermission.AccessRights
      description: Access rights of the recipient permission.
      type: Number
    - contextPath: EWS.RecipientPermission.Identity
      description: Identity of the recipient permission.
      type: String
    - contextPath: EWS.RecipientPermission.InheritanceType
      description: Inheritance type of the recipient permission.
      type: String
    - contextPath: EWS.RecipientPermission.IsInherited
      description: Whether the recipient permission is inherited.
      type: Boolean
    - contextPath: EWS.RecipientPermission.Trustee
      description: Trustee of the recipient permission.
      type: String
    description: Displays information about SendAs permissions that are configured for users.
    name: ews-recipient-permission-list
  - arguments:
    - description: The identity of the mailbox you want to view.
      name: identity
    - description: The maximum number of results to retrieve. Default is 10.
      name: limit
      defaultValue: '10'
    outputs:
    - contextPath: EWS.Recipient.Alias
      description: Recipient alias.
      type: String
    - contextPath: EWS.Recipient.DisplayName
      description: Recipient display name.
      type: String
    - contextPath: EWS.Recipient.DistinguishedName
      description: Recipient distinguished name.
      type: String
    - contextPath: EWS.Recipient.EmailAddresses
      description: Recipient email addresses.
      type: String
    - contextPath: EWS.Recipient.ExchangeVersion
      description: Recipient exchange version.
      type: String
    - contextPath: EWS.Recipient.ExternalDirectoryObjectId
      description: Recipient external directory object ID.
      type: String
    - contextPath: EWS.Recipient.Identity
      description: Recipient identity.
      type: String
    - contextPath: EWS.Recipient.Name
      description: Recipient name.
      type: String
    - contextPath: EWS.Recipient.OrganizationId
      description: Recipient organization ID.
      type: String
    - contextPath: EWS.Recipient.PrimarySmtpAddress
      description: Recipient primary SMTP address.
      type: String
    - contextPath: EWS.Recipient.RecipientType
      description: Recipient type.
      type: String
    - contextPath: EWS.Recipient.RecipientTypeDetails
      description: Recipient type details.
      type: String
    description: Displays existing recipient objects in your organization. This command returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).
    name: ews-recipient-list
  - name: ews-new-tenant-allow-block-list-items
    arguments:
    - name: entries
      required: true
      description: A comma-separated list of entries to add to the list (e.g. "Item1,Item2").
      isArray: true
    - name: list_type
      required: true
      auto: PREDEFINED
      predefined:
      - sender
      - filehash
      - url
      description: List type to add items to.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List subtype to add items to.
      defaultValue: Tenant
    - name: action
      required: true
      auto: PREDEFINED
      predefined:
      - Block
      - Allow
      description: Action to set for new entries.
    - name: notes
      description: Notes to include on new list entries.
    - name: expiration_date
      description: Enter a specific date and time for the new entries to expire using ISO format "YYYY-MM-DDTHH:MM:SSZ" for UTC time.  Alternately, a PowerShell **GetDate** statement can be used.
    - name: no_expiration
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to create list entries with no expiration date.  Cannot be used with "expiration_date".  If left false and no expiration date is set, default of 30 days will be used.
      defaultValue: 'false'
    outputs:
    - contextPath: EWS.NewTenantBlocks.Action
      description: List type ('Block' or 'Allow').
      type: string
    - contextPath: EWS.NewTenantBlocks.EntryValueHash
      description: Entry Value Hash.
      type: string
    - contextPath: EWS.NewTenantBlocks.Error
      description: Error (if any) returned by remote command.
    - contextPath: EWS.NewTenantBlocks.ExpirationDate
      description: DateTime the entry will expire and be removed.
      type: string
    - contextPath: EWS.NewTenantBlocks.Identity
      description: Unique identifier for the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.LastModifiedDateTime
      description: DateTime of last modification.
      type: string
    - contextPath: EWS.NewTenantBlocks.ListSubType
      description: List sub type (Tenant or AdvancedDelivery).
      type: string
    - contextPath: EWS.NewTenantBlocks.ModifiedBy
      description: User / App Registration which last modified this entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.Notes
      description: Custom notes added to the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.ObjectState
      description: State of the object (e.g. New/Modified/Deleted).
      type: string
    - contextPath: EWS.NewTenantBlocks.PSComputerName
      description: Name of Remote Powershell endpoint.
      type: string
    - contextPath: EWS.NewTenantBlocks.PSShowComputerName
      description: Flag whether or not remote computer name is shown in PS prompt.
      type: boolean
    - contextPath: EWS.NewTenantBlocks.RunspaceId
      description: RunspaceID of the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.SubmissionID
      description: SubmissionID of the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.SysManaged
      description: SysManaged property of the entry.
      type: boolean
    - contextPath: EWS.NewTenantBlocks.Value
      description: The value of the new entry created.
      type: string
    description: Add new items to the Tenant Allow/Block Lists.  Uses PowerShell New-TenantAllowBlockListItems cmdlet.
    execution: true
  - name: ews-email-security-block-sender-office-365-quick-action
    prettyname: "[Email Security] Block Sender - Office 365"
    quickaction: true
    hidden: true
    arguments:
    - name: entries
      required: true
      description: A comma-separated list of entries to add to the list (e.g. "Item1,Item2").
      isArray: true
      prettyname: Email Sender
      prettypredefined:
        Issue email sender: ${issue.xdmemailsender}
    - name: list_type
      defaultValue: sender
      auto: PREDEFINED
      predefined:
      - sender
      - filehash
      - url
      description: List type to add items to.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List subtype to add items to.
      defaultValue: Tenant
    - name: action
      hidden: true
      defaultValue: Block
      auto: PREDEFINED
      predefined:
      - Block
      - Allow
      description: Action to set for new entries.
    - name: notes
      description: Notes to include on new list entries.
    - name: expiration_date
      description: Enter a specific date and time for the new entries to expire using ISO format "YYYY-MM-DDTHH:MM:SSZ" for UTC time.  Alternately, a PowerShell **GetDate** statement can be used.
    - name: no_expiration
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to create list entries with no expiration date.  Cannot be used with "expiration_date".  If left false and no expiration date is set, default of 30 days will be used.
      defaultValue: 'true'
    outputs:
    - contextPath: EWS.NewTenantBlocks.Action
      description: List type ('Block' or 'Allow').
      type: string
    - contextPath: EWS.NewTenantBlocks.EntryValueHash
      description: Entry Value Hash.
      type: string
    - contextPath: EWS.NewTenantBlocks.Error
      description: Error (if any) returned by remote command.
    - contextPath: EWS.NewTenantBlocks.ExpirationDate
      description: DateTime the entry will expire and be removed.
      type: string
    - contextPath: EWS.NewTenantBlocks.Identity
      description: Unique identifier for the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.LastModifiedDateTime
      description: DateTime of last modification.
      type: string
    - contextPath: EWS.NewTenantBlocks.ListSubType
      description: List sub type (Tenant or AdvancedDelivery).
      type: string
    - contextPath: EWS.NewTenantBlocks.ModifiedBy
      description: User / App Registration which last modified this entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.Notes
      description: Custom notes added to the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.ObjectState
      description: State of the object (e.g. New/Modified/Deleted).
      type: string
    - contextPath: EWS.NewTenantBlocks.PSComputerName
      description: Name of Remote Powershell endpoint.
      type: string
    - contextPath: EWS.NewTenantBlocks.PSShowComputerName
      description: Flag whether or not remote computer name is shown in PS prompt.
      type: boolean
    - contextPath: EWS.NewTenantBlocks.RunspaceId
      description: RunspaceID of the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.SubmissionID
      description: SubmissionID of the entry.
      type: string
    - contextPath: EWS.NewTenantBlocks.SysManaged
      description: SysManaged property of the entry.
      type: boolean
    - contextPath: EWS.NewTenantBlocks.Value
      description: The value of the new entry created.
      type: string
    description: Add new items to the Tenant Allow/Block Lists.  Uses PowerShell New-TenantAllowBlockListItems cmdlet.
    execution: true
  - name: ews-get-tenant-allow-block-list-items
    arguments:
    - name: list_type
      required: true
      auto: PREDEFINED
      predefined:
      - sender
      - filehash
      - url
      description: List type to retrieve items from.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List subtype to retrieve items from.
      defaultValue: Tenant
    - name: action
      required: true
      auto: PREDEFINED
      predefined:
      - Block
      - Allow
      description: Action to filter entries by.
    - name: expiration_date
      description: Enter a specific date and time to filter entries by using ISO format "YYYY-MM-DDTHH:MM:SSZ" for UTC time.  Alternately, a PowerShell **GetDate** statement can be used.
    - name: no_expiration
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Filter list items that are set to never expire.
      defaultValue: 'false'
    - name: entry
      description: Specific entry value to retrieve.
    outputs:
    - contextPath: EWS.CurrentTenantBlocks.Action
      description: List type ('Block' or 'Allow').
      type: string
    - contextPath: EWS.CurrentTenantBlocks.EntryValueHash
      description: Entry Value Hash.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.Error
      description: Error (if any) returned by remote command.
      type: boolean
    - contextPath: EWS.CurrentTenantBlocks.ExpirationDate
      description: DateTime the entry will expire and be removed.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.Identity
      description: Unique identifier for the entry.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.LastModifiedDateTime
      description: DateTime of last modification.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.ListSubType
      description: List sub type (Tenant or AdvancedDelivery).
      type: string
    - contextPath: EWS.CurrentTenantBlocks.ModifiedBy
      description: User / App Registration which last modified this entry.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.Notes
      description: Custom notes added to the entry.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.ObjectState
      description: State of the object (e.g. New/Modified/Deleted).
      type: string
    - contextPath: EWS.CurrentTenantBlocks.PSComputerName
      description: Name of Remote Powershell endpoint.
    - contextPath: EWS.CurrentTenantBlocks.PSShowComputerName
      description: Flag whether or not remote computer name is shown in PS prompt.
      type: boolean
    - contextPath: EWS.CurrentTenantBlocks.RunspaceId
      description: RunspaceID of the entry.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.SubmissionID
      description: SubmissionID of the entry.
      type: string
    - contextPath: EWS.CurrentTenantBlocks.SysManaged
      description: SysManaged property of the entry.
      type: boolean
    - contextPath: EWS.CurrentTenantBlocks.Value
      description: The value of the new entry created.
      type: string
    description: Retrieve current Tenant Allow/Block List items.  Uses Get-TenantAllowBlockListItems cmdlet.
  - name: ews-get-tenant-allow-block-list-count
    arguments:
    - name: list_type
      auto: PREDEFINED
      predefined:
      - sender
      - filehash
      - url
      description: List type to retrieve items from.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List subtype to retrieve items from.
      defaultValue: Tenant
    outputs:
    - contextPath: EWS.CurrentListCount.Count
      description: Number of entries presently in the specified list.
      type: number
    - contextPath: EWS.CurrentListCount.ListSubType
      description: List sub type (Tenant or AdvancedDelivery).
      type: string
    - contextPath: EWS.CurrentListCount.ListType
      description: List type.
      type: string
    description: Retrieve current count of defined Tenant Allow/Block List items.  Uses Get-TenantAllowBlockListItems cmdlet.
  - arguments:
    - description: ID of the mailbox for which to get junk rules.
      name: mailbox
      required: true
    description: Gets junk rules for the specified mailbox.
    name: ews-junk-rules-get
    outputs:
    - contextPath: EWS.Rule.Junk.BlockedSendersAndDomains
      description: List of blocked senders and domains.
      type: String
    - contextPath: EWS.Rule.Junk.ContactsTrusted
      description: If true, contacts are trusted by default.
      type: Boolean
    - contextPath: EWS.Rule.Junk.Email
      description: Junk rule mailbox.
      type: String
    - contextPath: EWS.Rule.Junk.Enabled
      description: If true, junk rule is enabled.
      type: Boolean
    - contextPath: EWS.Rule.Junk.Identity
      description: Junk rule identity.
      type: String
    - contextPath: EWS.Rule.Junk.MailboxOwnerId
      description: ID of the mailbox owner.
      type: String
    - contextPath: EWS.Rule.Junk.TrustedListsOnly
      description: If true, only a list defined in the trusted lists are trusted.
      type: Boolean
    - contextPath: EWS.Rule.Junk.TrustedRecipientsAndDomains
      description: List of trusted recipients and domains.
      type: String
    - contextPath: EWS.Rule.Junk.TrustedSendersAndDomains
      description: List of trusted senders and domains.
      type: String
  - arguments:
    - description: ID of the mailbox for which to set junk rules.
      name: mailbox
      required: true
    - description: Comma-separated list of blocked senders and domains to add to the mailbox.
      isArray: true
      name: add_blocked_senders_and_domains
    - description: Comma-separated list of blocked senders and domains to remove from the mailbox.
      isArray: true
      name: remove_blocked_senders_and_domains
    - description: Comma-separated list of trusted senders and domains to add to the mailbox.
      isArray: true
      name: add_trusted_senders_and_domains
    - description: Comma-separated list of trusted senders and domains to remove from the mailbox.
      isArray: true
      name: remove_trusted_senders_and_domains
    - auto: PREDEFINED
      description: If true, trust only lists defined in the trusted lists. Can be "true" or "false".
      name: trusted_lists_only
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: If true, contacts are trusted by default. Can be "true" or "false".
      name: contacts_trusted
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: If true, the junk rule is enabled. Can be "true" or "false".
      name: enabled
      predefined:
      - 'true'
      - 'false'
    description: Sets junk rules for the specified mailbox.
    name: ews-junk-rules-set
  - arguments:
    - description: Comma-separated list of blocked senders and domains to add to the mailbox.
      isArray: true
      name: add_blocked_senders_and_domains
    - description: Comma-separated list of blocked senders and domains to remove from the mailbox.
      isArray: true
      name: remove_blocked_senders_and_domains
    - description: Comma-separated list of trusted senders and domains to add to the mailbox.
      isArray: true
      name: add_trusted_senders_and_domains
    - description: Comma-separated list of trusted senders and domains to remove from the mailbox.
      isArray: true
      name: remove_trusted_senders_and_domains
    - auto: PREDEFINED
      description: If true, trust only lists defined in the trusted lists. Can be "true" or "false".
      name: trusted_lists_only
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: If true, contacts are trusted by default. Can be "true" or "false".
      name: contacts_trusted
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: If true, the junk rule is enabled. Can be "true" or "false".
      name: enabled
      predefined:
      - 'true'
      - 'false'
    description: Sets junk rules in all managed accounts.
    name: ews-global-junk-rules-set
  - arguments:
    - description: A comma-separated list of sender email addresses by which to filter the results.
      isArray: true
      name: sender_address
    - description: A comma-separated list of recipient email addresses by which to filter the results.
      isArray: true
      name: recipient_address
    - description: The source IP address used to filter results. For incoming messages, from_ip is the public IP of the SMTP server that sent the message. For outgoing messages from Exchange Online, the value is blank.
      name: from_ip
    - description: The destination IP address used to filter results. For outgoing messages, the to_ip value is the public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, this value is blank.
      name: to_ip
    - description: The Message-ID header field of the message by which to filter the results. This value is also known as the Client ID. The format of the Message-ID depends on the messaging server that sent the message. The value should be unique for each message. However, not all messaging servers create values for the Message-ID in the same way. Be sure to include the full Message ID string (which may include angle brackets) and enclose the value in quotation marks (for example,"d9683b4c-127b-413a-ae2e-fa7dfb32c69d@DM3NAM06BG401.Eop-nam06.prod.protection.outlook.com").
      name: message_id
    - description: The message trace ID to be used with the recipient address to uniquely identify a message trace and obtain more details. A message trace ID is generated for every message that's processed by the system.
      name: message_trace_id
    - defaultValue: '1'
      description: The page number of the results you want to view. Can be an integer between 1 and 1000.
      name: page
    - defaultValue: '100'
      description: The maximum number of entries per page. Can be an integer between 1 and 5000.
      name: page_size
    - description: "The start date of the date range. Use the short date format that''s defined in the Regional Options settings on the computer where you''re running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.\nYou can enter the date only, or you can enter the date and time of day.\nIf you enter the date and time of day, enclose the value in quotation marks (\"), for example, \"09/01/2018 5:00 PM\".\nValid input for this parameter is from 10 days ago until now. Default is 48 hours ago."
      name: start_date
    - description: "The end date of the date range. Use the short date format that''s defined in the Regional Options settings on the computer where you''re running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018.\nYou can enter the date only, or you can enter the date and time of day.\nIf you enter the date and time of day, enclose the value in quotation marks (\"), for example, \"09/01/2018 5:00 PM\".\nValid input for this parameter is from the start_date - now. Default is now."
      name: end_date
    - auto: PREDEFINED
      description: "The status of the message. Can be one of the following:\n  * GettingStatus: The message is waiting for status update.\n  * Failed: Message delivery was attempted and it failed or the message was filtered as spam or malware, or by transport rules.\n  * Pending: Message delivery is underway or was deferred and is being retried.\n  * Delivered: The message was delivered to its destination.\n  * Expanded: There was no message delivery because the message was addressed to a distribution group and the membership of the distribution was expanded.\n  * Quarantined: The message was quarantined.\n  * FilteredAsSpam: The message was marked as spam.\n"
      name: status
      predefined:
      - GettingStatus
      - Failed
      - Pending
      - Delivered
      - Expanded
      - Quarantined
      - FilteredAsSpam
    description: '(Deprecated) Searches message data for the last 10 days. If you run this command without any arguments, only data from the last 48 hours is returned.

      If you enter a start date that is older than 10 days, you will receive an error and the command will return no results.

      This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.'
    name: ews-message-trace-get
    deprecated: true
    outputs:
    - contextPath: EWS.MessageTrace.FromIP
      description: The public IP address of the SMTP email server that sent the message.
      type: String
    - contextPath: EWS.MessageTrace.ToIP
      description: The public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, the value is blank.
      type: String
    - contextPath: EWS.MessageTrace.Index
      description: Message index in pagination. (Index starts from 0.)
      type: Number
    - contextPath: EWS.MessageTrace.MessageId
      description: Message-ID header field of the message.
      type: String
    - contextPath: EWS.MessageTrace.MessageTraceId
      description: Message trace ID of the message.
      type: String
    - contextPath: EWS.MessageTrace.Organization
      description: Message trace organization source.
      type: String
    - contextPath: EWS.MessageTrace.Received
      description: Message receive time.
      type: Date
    - contextPath: EWS.MessageTrace.RecipientAddress
      description: Message recipient address.
      type: String
    - contextPath: EWS.MessageTrace.SenderAddress
      description: Message sender address.
      type: String
    - contextPath: EWS.MessageTrace.Size
      description: Message size in bytes.
      type: Number
    - contextPath: EWS.MessageTrace.StartDate
      description: Message trace start date.
      type: Date
    - contextPath: EWS.MessageTrace.EndDate
      description: Message trace end date.
      type: Date
    - contextPath: EWS.MessageTrace.Status
      description: Message status.
      type: String
    - contextPath: EWS.MessageTrace.Subject
      description: Message subject.
      type: String
  - arguments:
    - description: A comma-separated list of sender email addresses used to filter results.
      isArray: true
      name: sender_address
    - description: A comma-separated list of recipient email addresses used to filter results.
      isArray: true
      name: recipient_address
    - description: The source IP address used to filter results. For incoming messages, from_ip is the public IP of the SMTP server that sent the message. For outgoing messages from Exchange Online, the value is blank.
      name: from_ip
    - description: The destination IP address used to filter results. For outgoing messages, the to_ip value is the public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, this value is blank.
      name: to_ip
    - description: The Message-ID header field used to filter results, also known as the Client ID, should be unique for each message. The format depends on the sending server, and not all servers generate it the same way. Include the full Message-ID string (may include angle brackets) and enclose it in quotes, e.g., "d9683b4c-127b-413a-ae2e-fa7dfb32c69d@DM3NAM06BG401.Eop-nam06.prod.protection.outlook.com".
      isArray: true
      name: message_id
    - description: The message trace ID to be used with the recipient address to uniquely identify a message trace and obtain more details. A message trace ID is generated for every message that's processed by the system.
      name: message_trace_id
    - description: "The start date of the date range. Use the short date format defined in the Regional Options settings on the computer where you run the command. For example, if the format is mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or the date and time. If entering both date and time, enclose the value in quotation marks (\") — for example, \"09/01/2018 5:00 PM. Valid input is from 10 days ago until now. The default is 48 hours ago."
      name: start_date
    - description: "The end date of the date range. Use the short date format defined in the Regional Options settings on the computer where you run the command. For example, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or the date and time (enclose the value in quotation marks, e.g., \"09/01/2018 5:00 PM\"). Valid input is from the start_date until now. The default is now."
      name: end_date
    - auto: PREDEFINED
      description: "The status of the message. Can be one of the following:\n  * GettingStatus: The message is pending a status update.\n  * Failed: The message delivery was attempted but failed, or the message was filtered as spam, malware, or by transport rules.\n  * Pending: Message delivery is in progress or was deferred and is being retried.\n  * Delivered: The message was successfully delivered to its destination.\n  * Expanded: No message was delivered because the message was sent to a distribution group; the group's membership was expanded instead.\n  * Quarantined: The message was quarantined.\n  * FilteredAsSpam: The message was marked as spam.\n"
      isArray: true
      name: status
      predefined:
      - GettingStatus
      - Failed
      - Pending
      - Delivered
      - Expanded
      - Quarantined
      - FilteredAsSpam
    - description: Filters results by the subject of the message. If the value contains spaces, enclose it in quotation marks (").
      name: subject
    - description: "The subject_filter_type parameter specifies how the value of the subject parameter is evaluated. Valid values are:\n  * Contains\n  * EndsWith\n  * StartsWith\n It is recommend to use StartsWith or EndsWith instead of Contains whenever possible."
      name: subject_filter_type
    - description: The starting_recipient_address parameter is used with the end_date parameter to query subsequent data while avoiding duplicates. For subsequent queries, use the Recipient address and Received Time from the last record of the previous results as the values for starting_recipient_address and end_date, respectively.
      name: starting_recipient_address
    - description: The limit parameter specifies the maximum number of results to return. A valid value is from 1 to 5000. The default value is 1000.
      name: limit
    description: 'Searches message data from the last 90 days. If you run this command without any arguments, only data from the last 48 hours is returned.

      If you enter a start date that is older than 90 days, you will receive an error and the command will return no results.

      This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.'
    name: ews-message-trace-list
    outputs:
    - contextPath: EWS.MessageTrace.FromIP
      description: The public IP address of the SMTP email server that sent the message.
      type: String
    - contextPath: EWS.MessageTrace.ToIP
      description: The public IP address in the resolved MX record for the destination domain. For incoming messages to Exchange Online, the value is blank.
      type: String
    - contextPath: EWS.MessageTrace.MessageId
      description: Message-ID header field of the message.
      type: String
    - contextPath: EWS.MessageTrace.MessageTraceId
      description: Message trace ID of the message.
      type: String
    - contextPath: EWS.MessageTrace.Received
      description: Message receive time.
      type: Date
    - contextPath: EWS.MessageTrace.RecipientAddress
      description: Message recipient address.
      type: String
    - contextPath: EWS.MessageTrace.SenderAddress
      description: Message sender address.
      type: String
    - contextPath: EWS.MessageTrace.Size
      description: Message size in bytes.
      type: Number
    - contextPath: EWS.MessageTrace.Status
      description: Message status.
      type: String
    - contextPath: EWS.MessageTrace.Subject
      description: Message subject.
      type: String
  - arguments:
    - description: The domain controller identified by its fully qualified domain name (FQDN). For example, dc01.contoso.com. This argument is available only in on-premises Exchange.
      name: domain_controller
    - description: The federation trust ID. If not specified, the command returns all federation trusts configured for the Exchange organization.
      name: identity
    description: Displays the federation trust configured for the Exchange organization.
    name: ews-federation-trust-get
    outputs:
    - contextPath: EWS.FederationTrust.AdminDisplayName
      description: Administrator display name of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ApplicationIdentifier
      description: Application identifier of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ApplicationUri
      description: Application URI of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.DistinguishedName
      description: Distinguished name of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ExchangeObjectId
      description: Exchange object ID of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ExchangeVersion
      description: Exchange version of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.Guid
      description: GUID of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.Id
      description: ID of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.Identity
      description: Identity of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.IsValid
      description: Whether the federation trust is valid.
      type: Boolean
    - contextPath: EWS.FederationTrust.MetadataEpr
      description: Metadata EPR of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.MetadataPollInterval
      description: Metadata poll interval of the federation trust.
      type: Date
    - contextPath: EWS.FederationTrust.MetadataPutEpr
      description: Metadata put EPR of the federation trust.
      type: Unknown
    - contextPath: EWS.FederationTrust.Name
      description: Name of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.NamespaceProvisioner
      description: Namespace provisioner of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ObjectCategory
      description: Object category of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ObjectClass
      description: Object class of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.ObjectState
      description: Object state of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Archived
      description: Whether the organization certificate of the federation trust is archived.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.Critical
      description: Whether the extensions of the organization certificate are critical.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.Oid.FriendlyName
      description: Friendly name of the OID of the organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.Oid.Value
      description: Value of the OID of the organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.RawData
      description: Raw data of the organization certificate extensions.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.SubjectKeyIdentifier
      description: Subject key identifier of the organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.KeyUsages
      description: Key usages of the organization certificate extensions.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.EnhancedKeyUsages.FriendlyName
      description: Friendly name of the enhanced key usages of the organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.EnhancedKeyUsages.Value
      description: Value of the enhanced key usages of the organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.CertificateAuthority
      description: Whether the organization certificate extensions have a certificate authority.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.HasPathLengthConstraint
      description: Whether the organization certificate extensions have a path length constraint.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgCertificate.Extensions.PathLengthConstraint
      description: Path length constraint of the organization certificate extensions.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.FriendlyName
      description: Friendly name of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Handle.value
      description: The handle value of the organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.HasPrivateKey
      description: Whether the organization certificate has a private key.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgCertificate.Issuer
      description: Issuer of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.IssuerName.Name
      description: Name of the issuer of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.IssuerName.Oid.FriendlyName
      description: Friendly Name of the OID of the issuer name of the organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgCertificate.IssuerName.Oid.Value
      description: Value of the OID of the issuer name of the organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgCertificate.IssuerName.RawData
      description: Raw data of the issuer name of the organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.NotAfter
      description: The date until when the organization certificate is valid.
      type: Date
    - contextPath: EWS.FederationTrust.OrgCertificate.NotBefore
      description: The date the organization certificate became valid.
      type: Date
    - contextPath: EWS.FederationTrust.OrgCertificate.PrivateKey
      description: Private key of the organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName
      description: Friendly name of the OID of the encoded key value of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.Oid.Value
      description: Value of the OID of the encoded key value of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedKeyValue.RawData
      description: Raw data of the encoded key value of the public key.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.Oid.FriendlyName
      description: Friendly name of the OID of the encoded parameters of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.Oid.Value
      description: Value of the OID of the encoded parameters of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.EncodedParameters.RawData
      description: Raw data of the encoded parameters of the public key.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Key.KeyExchangeAlgorithm
      description: Key exchange algorithm of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.MaxSize
      description: Maximum size of the public key.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.MinSize
      description: Minimum size of the public key.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Key.LegalKeySizes.SkipSize
      description: SkipSize of the public key.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Key.SignatureAlgorithm
      description: Signature algorithm of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Oid.FriendlyName
      description: Friendly name of the OID of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.PublicKey.Oid.Value
      description: Value of the OID of the public key.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.RawData
      description: Raw data of the organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.SerialNumber
      description: Serial number of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.SignatureAlgorithm.FriendlyName
      description: Friendly name of the signature algorithm.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.SignatureAlgorithm.Value
      description: Value of the signature algorithm.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Subject
      description: Subject of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.SubjectName.Name
      description: Name of the subject of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.SubjectName.Oid.FriendlyName
      description: Friendly name of the OID of the subject name.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgCertificate.SubjectName.Oid.Value
      description: Value of the OID of the subject name.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgCertificate.SubjectName.RawData
      description: Raw Data of the subject name.
      type: Number
    - contextPath: EWS.FederationTrust.OrgCertificate.Thumbprint
      description: Thumbprint of the organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgCertificate.Version
      description: Version of the organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgNextCertificate
      description: Next organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgNextPrivCertificate
      description: Next organization private certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Archived
      description: Whether to archive the previous organization certificate.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.Critical
      description: Whether the extensions of the previous organization certificate are critical.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.Oid.FriendlyName
      description: Friendly name of the OID of the previous organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.Oid.Value
      description: Value of the OID of the previous organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.RawData
      description: Raw data of the previous organization certificate extensions.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.SubjectKeyIdentifier
      description: Subject key identifier of the previous organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.KeyUsages
      description: Key usages of the previous organization certificate extensions.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.EnhancedKeyUsages.FriendlyName
      description: Friendly name of the enhanced key usages of the previous organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Extensions.EnhancedKeyUsages.Value
      description: Value of the enhanced key usages of the previous organization certificate extensions.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.FriendlyName
      description: Friendly name of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Handle.value
      description: Value of the handle of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.HasPrivateKey
      description: Whether the previous organization certificate has a private key.
      type: Boolean
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Issuer
      description: Issuer of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.IssuerName.Name
      description: Name of the issuer of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.IssuerName.Oid.FriendlyName
      description: Friendly name of the OID of the issuer of the previous organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.IssuerName.Oid.Value
      description: Value of the OID of the issuer of the previous organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.IssuerName.RawData
      description: Raw data of the issuer of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.NotAfter
      description: The date until when the previous organization certificate is valid.
      type: Date
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.NotBefore
      description: The date the previous organization certificate became valid.
      type: Date
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PrivateKey
      description: Private Key of the previous organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName
      description: Friendly Name of the OID of the encoded key value of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.Oid.Value
      description: Value of the OID of the encoded key value of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedKeyValue.RawData
      description: Raw Data of the encoded key value of the public key of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.Oid.FriendlyName
      description: Friendly name of the OID of the encoded parameters of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.Oid.Value
      description: Value of the OID of the encoded parameters of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.EncodedParameters.RawData
      description: Raw Data of the encoded parameters of the public key of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.KeyExchangeAlgorithm
      description: Key exchange algorithm of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.MaxSize
      description: Maximum size of the public key of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.MinSize
      description: Minimum size of the public key of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.LegalKeySizes.SkipSize
      description: SkiPSize of the public key of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Key.SignatureAlgorithm
      description: Signature algorithm of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Oid.FriendlyName
      description: Friendly name of the OID of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.PublicKey.Oid.Value
      description: Value of the OID of the public key of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.RawData
      description: Raw Data of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SerialNumber
      description: Serial number of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SignatureAlgorithm.FriendlyName
      description: Friendly name of the signature algorithm of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SignatureAlgorithm.Value
      description: Value of the signature algorithm of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Subject
      description: Subject of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SubjectName.Name
      description: Name of the subject of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SubjectName.Oid.FriendlyName
      description: Friendly name of the OID of the subject of the previous organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SubjectName.Oid.Value
      description: Value of the OID of the subject name of the previous organization certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.SubjectName.RawData
      description: Raw Data of the subject name of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Thumbprint
      description: Thumbprint of the previous organization certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrevCertificate.Version
      description: Version of the previous organization certificate.
      type: Number
    - contextPath: EWS.FederationTrust.OrgPrevPrivCertificate
      description: Organization previous private certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrgPrivCertificate
      description: Organization private certificate.
      type: String
    - contextPath: EWS.FederationTrust.OrganizationId
      description: Organization ID.
      type: String
    - contextPath: EWS.FederationTrust.OriginatingServer
      description: Originating server.
      type: String
    - contextPath: EWS.FederationTrust.PSComputerName
      description: PowerShell computer name.
      type: String
    - contextPath: EWS.FederationTrust.PSShowComputerName
      description: Whether to show the PowerShell computer name.
      type: Boolean
    - contextPath: EWS.FederationTrust.PolicyReferenceUri
      description: Policy Reference URI.
      type: String
    - contextPath: EWS.FederationTrust.RunspaceId
      description: Runspace ID.
      type: String
    - contextPath: EWS.FederationTrust.TimesOfUnmatchPartner
      description: Times Of unmatch partner.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertReference
      description: Token issuer certificate reference.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Archived
      description: Whether the token issuer certificate is archived.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.Critical
      description: Whether the extensions of the token issuer certificate are critical.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.Oid.FriendlyName
      description: Friendly name of the OID of the extensions of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.Oid.Value
      description: Value of the OID of the extensions of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.RawData
      description: Raw Data of the extensions of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.SubjectKeyIdentifier
      description: Subject key identifier of the extensions of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Extensions.KeyUsages
      description: Key usages of the extensions of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.FriendlyName
      description: Friendly name of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Handle.value
      description: Value of the handle of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.HasPrivateKey
      description: Whether the token issuer certificate has a private key.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Issuer
      description: Issuer of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Name
      description: Name of the issuer of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Oid.FriendlyName
      description: Friendly name of the OID of the token issuer certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.IssuerName.Oid.Value
      description: Value of the OID of the issuer of the token issuer certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.IssuerName.RawData
      description: Raw data of the issuer of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.NotAfter
      description: The date until when the token issuer certificate is valid.
      type: Date
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.NotBefore
      description: The date the token issuer certificate became valid.
      type: Date
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PrivateKey
      description: Private key of the token issuer certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName
      description: Friendly name of the OID of the encoded key value of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.Oid.Value
      description: Value of the OID of the encoded key value of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedKeyValue.RawData
      description: Raw data of the encoded key value of the public key of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.Oid.FriendlyName
      description: Friendly name of the OID of the encoded parameters of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.Oid.Value
      description: Value of the OID of the encoded parameters of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.EncodedParameters.RawData
      description: Raw Data of the encoded parameters of the public key of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.KeyExchangeAlgorithm
      description: Key exchange algorithm of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.MaxSize
      description: Maximum size of the public key of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.MinSize
      description: Minimum size of the public key of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.LegalKeySizes.SkipSize
      description: SkiPSize of the public key of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Key.SignatureAlgorithm
      description: Signature algorithm of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Oid.FriendlyName
      description: Friendly name of the OID of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.PublicKey.Oid.Value
      description: Value of the OID of the public key of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.RawData
      description: Raw Data of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SerialNumber
      description: Serial number of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SignatureAlgorithm.FriendlyName
      description: Friendly name of the signature algorithm of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SignatureAlgorithm.Value
      description: Value of the signature algorithm of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Subject
      description: Subject of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Name
      description: Name of the subject of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Oid.FriendlyName
      description: Friendly name of the OID of the subject of the token issuer certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SubjectName.Oid.Value
      description: Value of the OID of the subject of the token issuer certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.SubjectName.RawData
      description: Raw data of the subject of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Thumbprint
      description: Thumbprint of the token issuer certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerCertificate.Version
      description: Version of the token issuer certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerEpr
      description: Token issuer EPR.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerMetadataEpr
      description: Token issuer metadata EPR.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertReference
      description: Token issuer previous certificate reference.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Archived
      description: Whether the token issuer previous certificate was archived.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Critical
      description: Whether the extensions of the token issuer previous certificate was critical.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Oid.FriendlyName
      description: Friendly name of the OID of the extensions of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.Oid.Value
      description: Value of the OID of the extensions of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.RawData
      description: Raw data of the extensions of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.SubjectKeyIdentifier
      description: Subject key identifier of the extensions of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Extensions.KeyUsages
      description: Key usages of the extensions of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.FriendlyName
      description: Friendly name of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Handle.value
      description: The handle value of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.HasPrivateKey
      description: Whether the token issuer previous certificate has a private key.
      type: Boolean
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Issuer
      description: Issuer of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Name
      description: Name of the issuer of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Oid.FriendlyName
      description: Friendly name of the OID of the issuer name of the token issuer previous certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.Oid.Value
      description: Value of the OID of the issuer name of the token issuer previous certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.IssuerName.RawData
      description: Raw Data of the issuer name of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.NotAfter
      description: The date until when the token issuer previous certificate is valid.
      type: Date
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.NotBefore
      description: The date the token issuer previous certificate became valid.
      type: Date
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PrivateKey
      description: Private Key of the token issuer previous certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.Oid.FriendlyName
      description: Friendly name of the OID of the encoded key value of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.Oid.Value
      description: Value of the OID of the encoded key value of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedKeyValue.RawData
      description: Raw data of the encoded key value of the public key of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.Oid.FriendlyName
      description: Friendly name of the OID of the encoded parameters of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.Oid.Value
      description: Value of the OID of the encoded parameters of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.EncodedParameters.RawData
      description: Raw data of the encoded parameters of the public key of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.KeyExchangeAlgorithm
      description: Key exchange algorithm of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.MaxSize
      description: Maximum size of the public key of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.MinSize
      description: Minimum size of the public key of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.LegalKeySizes.SkipSize
      description: SkiPSize of the public key of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Key.SignatureAlgorithm
      description: Signature algorithm of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Oid.FriendlyName
      description: Friendly Name of the OID of the public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.PublicKey.Oid.Value
      description: Value of the OID of teh public key of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.RawData
      description: Raw Data of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SerialNumber
      description: Serial number of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SignatureAlgorithm.FriendlyName
      description: Friendly name of the signature algorithm of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SignatureAlgorithm.Value
      description: Value of the signature algorithm of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Subject
      description: Subject of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Name
      description: Name of the subject of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Oid.FriendlyName
      description: Friendly Name of the OID of the subject of the token issuer previous certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.Oid.Value
      description: Value of the OID of the subject name of the token issuer previous certificate.
      type: Unknown
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.SubjectName.RawData
      description: Raw data of the subject name of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Thumbprint
      description: Thumbprint of the token issuer previous certificate.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerPrevCertificate.Version
      description: Version of the token issuer previous certificate.
      type: Number
    - contextPath: EWS.FederationTrust.TokenIssuerType
      description: Token issuer type of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.TokenIssuerUri
      description: Token Issuer UIR of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.WebRequestorRedirectEpr
      description: Web requestor redirect EPR of the federation trust.
      type: String
    - contextPath: EWS.FederationTrust.WhenChanged
      description: The date the federation trust was changed.
      type: Date
    - contextPath: EWS.FederationTrust.WhenChangedUTC
      description: The date in UTC format of when the federation trust was changed.
      type: Date
    - contextPath: EWS.FederationTrust.WhenCreated
      description: The date the federation trust was created.
      type: Date
    - contextPath: EWS.FederationTrust.WhenCreatedUTC
      description: The date in UTC format of when the federation trust was created.
      type: Date
  - arguments:
    - description: 'The fully qualified domain name (FQDN) of the domain controller. For example, dc01.contoso.com. This argument is available only in on-premises Exchange.'
      name: domain_controller
    - description: The federation trust ID. If not specified, all federation trusts configured for the Exchange organization are returned.
      name: identity
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'The IncludeExtendedDomainInfo switch specifies that the command query Microsoft Federation Gateway for the status of each accepted domain that''s federated. The status is returned with each domain in the Domains property. Possible values: "true" and "false".'
      name: include_extended_domain_info
      predefined:
      - 'true'
      - 'false'
    description: Retrieves the Exchange organization's federated organization identifier and related details, such as federated domains, organization contact, and status.
    name: ews-federation-configuration-get
    outputs:
    - contextPath: EWS.FederationConfiguration.AccountNamespace
      description: Account namespace of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.DefaultDomain
      description: Default domain of the federation configuration.
      type: Unknown
    - contextPath: EWS.FederationConfiguration.DelegationTrustLink
      description: Delegation trust link of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.DistinguishedName
      description: Distinguished name of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.Domains
      description: Domains of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.Enabled
      description: Whether the federation configuration is enabled.
      type: Boolean
    - contextPath: EWS.FederationConfiguration.ExchangeObjectId
      description: Exchange object ID of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.ExchangeVersion
      description: Exchange version of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.Guid
      description: GUID of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.Id
      description: ID of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.Identity
      description: Identity of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.IsValid
      description: Whether the federation configration is valid.
      type: Boolean
    - contextPath: EWS.FederationConfiguration.Name
      description: Name of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.ObjectCategory
      description: Object category of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.ObjectClass
      description: Object class of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.ObjectState
      description: Object state of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.OrganizationContact
      description: Organization contact of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.OrganizationId
      description: Organization ID of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.OriginatingServer
      description: Originating server of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.PSComputerName
      description: PowerShell computer name of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.PSShowComputerName
      description: Whether to show the PowerShell computer name of the federation configuration.
      type: Boolean
    - contextPath: EWS.FederationConfiguration.RunspaceId
      description: Runspace ID of the federation configuration.
      type: String
    - contextPath: EWS.FederationConfiguration.WhenChanged
      description: The date the federation configuration was changed.
      type: Date
    - contextPath: EWS.FederationConfiguration.WhenChangedUTC
      description: The date in UTC format of when the federation configuration was changed.
      type: Date
    - contextPath: EWS.FederationConfiguration.WhenCreated
      description: The date the federation configuration was created.
      type: Date
    - contextPath: EWS.FederationConfiguration.WhenCreatedUTC
      description: The date in UTC format of when the federation configuration was created.
      type: Date
  - arguments:
    - description: |-
        The fully qualified domain name (FQDN) of the domain controller. For example, dc01.contoso.com.
        This argument is available only in on-premises Exchange.
      name: domain_controller
    - description: The remote domain that you want to view. You can use the GUID, ID, or any other identifier.
      name: identity
    description: Gets the configuration information for the remote domains configured in your organization. This command is available only in the Exchange Online PowerShell V2 module.
    name: ews-remote-domain-get
    outputs:
    - contextPath: EWS.RemoteDomain.AdminDisplayName
      description: Admin display name of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.AllowedOOFType
      description: Allowed OOF type of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.AutoForwardEnabled
      description: Whether auto forward is enabled for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.AutoReplyEnabled
      description: Whether auto reply is enabled for the remote domain..
      type: Boolean
    - contextPath: EWS.RemoteDomain.ByteEncoderTypeFor7BitCharsets
      description: Byte encoder type For 7-bit charsets of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.CharacterSet
      description: Character set of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ContentType
      description: Content type of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.DeliveryReportEnabled
      description: Whether delivery report is enabled for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.DisplaySenderName
      description: Whether to display the sender name for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.DistinguishedName
      description: Distinguished name of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.DomainName
      description: Domain name of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ExchangeObjectId
      description: Exchange object ID of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ExchangeVersion
      description: Exchange version of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.Guid
      description: GUID of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.Id
      description: ID of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.Identity
      description: Identity of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.IsInternal
      description: Whether the remote domain is internal.
      type: Boolean
    - contextPath: EWS.RemoteDomain.IsValid
      description: Whether the remote domain is valid.
      type: Boolean
    - contextPath: EWS.RemoteDomain.LineWrapSize
      description: Line wrap size for the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.MeetingForwardNotificationEnabled
      description: Whether meeting forward notification is enabled for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.MessageCountThreshold
      description: Message count threshold  of the remote domain.
      type: Number
    - contextPath: EWS.RemoteDomain.NDRDiagnosticInfoEnabled
      description: Whether NDR diagnostic information is enabled for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.NDREnabled
      description: Whether NDR is enabled for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.Name
      description: Name of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.NonMimeCharacterSet
      description: Non-mime character set of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ObjectCategory
      description: Object category of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ObjectClass
      description: Object class of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.ObjectState
      description: Object state of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.OrganizationId
      description: Organization ID of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.OriginatingServer
      description: Originating server of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.PSComputerName
      description: PowerShell computer name of the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.PSShowComputerName
      description: Whether to show the PowerShell computer name for the remote domain.
      type: Boolean
    - contextPath: EWS.RemoteDomain.PreferredInternetCodePageForShiftJis
      description: Preferred internet code page for shift JIS for the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.RequiredCharsetCoverage
      description: Required charset coverage for the remote domain.
      type: Unknown
    - contextPath: EWS.RemoteDomain.RunspaceId
      description: Runspace ID for the remote domain.
      type: String
    - contextPath: EWS.RemoteDomain.TNEFEnabled
      description: Whether TNEF is enabled for the remote domain.
      type: Unknown
    - contextPath: EWS.RemoteDomain.TargetDeliveryDomain
      description: Whether the remote domain is used for the target email address of mail users that represent the users in the other forest.
      type: Boolean
    - contextPath: EWS.RemoteDomain.TrustedMailInboundEnabled
      description: Whether inbound trusted mail is enabled.
      type: Boolean
    - contextPath: EWS.RemoteDomain.TrustedMailOutboundEnabled
      description: Whether outbound trusted mail is enabled.
      type: Boolean
    - contextPath: EWS.RemoteDomain.UseSimpleDisplayName
      description: Whether to use the simple display name.
      type: Boolean
    - contextPath: EWS.RemoteDomain.WhenChanged
      description: The date the remote domain was changed.
      type: Date
    - contextPath: EWS.RemoteDomain.WhenChangedUTC
      description: The date in UTC format of when the remote domain was changed.
      type: Date
    - contextPath: EWS.RemoteDomain.WhenCreated
      description: The date the remote domain was created.
      type: Date
    - contextPath: EWS.RemoteDomain.WhenCreatedUTC
      description: The date in UTC format of when the remote domain was created.
      type: Date
  - arguments:
    - description: The mailbox you want to view.
      name: identity
    - description: The object's location in Active Directory by which to filter the results.
      name: organizational_unit
    - defaultValue: 10
      description: Maximum number of users to get. A value of 0 means to get all users.
      name: limit
    description: Displays the existing user objects in your organization.
    name: ews-user-list
    outputs:
    - contextPath: EWS.User.AccountDisabled
      description: Whether the user account is disabled.
      type: Boolean
    - contextPath: EWS.User.AllowUMCallsFromNonUsers
      description: Whether to allow Unified Messaging calls from non-users.
      type: Boolean
    - contextPath: EWS.User.ArchiveRelease
      description: The archive release of the user object.
      type: String
    - contextPath: EWS.User.AssistantName
      description: The assistant name of the user object.
      type: String
    - contextPath: EWS.User.AuthenticationPolicy
      description: The authentication policy of the user object.
      type: Unknown
    - contextPath: EWS.User.CanHaveCloudCache
      description: Whether the user object can have cloud cache.
      type: Boolean
    - contextPath: EWS.User.City
      description: The city of the user object.
      type: String
    - contextPath: EWS.User.CloudCacheAccountType
      description: Cloud cache account type of the user object.
      type: String
    - contextPath: EWS.User.CloudCacheProvider
      description: Cloud cache provider of the user object.
      type: Number
    - contextPath: EWS.User.CloudCacheRemoteEmailAddress
      description: Cloud cache remote email address of the user object.
      type: String
    - contextPath: EWS.User.CloudCacheScope
      description: Cloud cache scope of the user object.
      type: Number
    - contextPath: EWS.User.CloudCacheUserName
      description: Cloud cache user name of the user object.
      type: String
    - contextPath: EWS.User.Company
      description: Company of the user object.
      type: String
    - contextPath: EWS.User.ConsumerNetID
      description: Consumer net ID of the user object.
      type: Unknown
    - contextPath: EWS.User.CountryOrRegion
      description: Country or region of the .
      type: String
    - contextPath: EWS.User.DefaultMailboxWorkloadsMask
      description: Default mailbox workloads mask of the user object.
      type: Unknown
    - contextPath: EWS.User.Department
      description: Department of the user object.
      type: String
    - contextPath: EWS.User.DesiredMailboxWorkloads
      description: Desired mailbox workloads of the user object.
      type: Unknown
    - contextPath: EWS.User.DesiredMailboxWorkloadsGracePeriod
      description: Desired mailbox workloads grace period of the user object.
      type: Unknown
    - contextPath: EWS.User.DesiredMailboxWorkloadsModified
      description: Modified desired mailbox workloads of the user object.
      type: Unknown
    - contextPath: EWS.User.DisplayName
      description: Display name of the user object.
      type: String
    - contextPath: EWS.User.DistinguishedName
      description: Distinguished name of the user object.
      type: String
    - contextPath: EWS.User.ExchangeObjectId
      description: Exchange object ID of the user object.
      type: String
    - contextPath: EWS.User.ExchangeVersion
      description: Exchange version of the user object.
      type: String
    - contextPath: EWS.User.ExternalDirectoryObjectId
      description: External Directory Object ID of the user object.
      type: String
    - contextPath: EWS.User.Fax
      description: Fax of the user object.
      type: String
    - contextPath: EWS.User.FirstName
      description: First name of the user object.
      type: String
    - contextPath: EWS.User.GeoCoordinates
      description: Geo coordinates of the user object.
      type: Unknown
    - contextPath: EWS.User.Guid
      description: GUID of the user object.
      type: String
    - contextPath: EWS.User.HomePhone
      description: Home phone of the user object.
      type: String
    - contextPath: EWS.User.Id
      description: ID of the user object.
      type: String
    - contextPath: EWS.User.Identity
      description: Identity of the user object.
      type: String
    - contextPath: EWS.User.Initials
      description: Initials of the user object.
      type: String
    - contextPath: EWS.User.IsCloudCache
      description: Whether there is a cloud cache for the user object.
      type: Boolean
    - contextPath: EWS.User.IsCloudCacheBlocked
      description: Whether the cloud cache is blocked.
      type: Boolean
    - contextPath: EWS.User.IsCloudCacheProvisioningComplete
      description: Whether cloud cache provisioning is complete.
      type: Boolean
    - contextPath: EWS.User.IsDirSynced
      description: Whether the directory is synched.
      type: Boolean
    - contextPath: EWS.User.IsInactiveMailbox
      description: Whether the mailbox is inactive.
      type: Boolean
    - contextPath: EWS.User.IsLinked
      description: Whether the user object is linked.
      type: Boolean
    - contextPath: EWS.User.IsSecurityPrincipal
      description: Whether there is a security principal.
      type: Boolean
    - contextPath: EWS.User.IsSoftDeletedByDisable
      description: Whether soft delete is disabled and hard (permanent) delete occurs.
      type: Boolean
    - contextPath: EWS.User.IsSoftDeletedByRemove
      description: When the Exchange Online mailbox is deleted (soft delete), this property is set to True.
      type: Boolean
    - contextPath: EWS.User.IsValid
      description: Whether the user object is valid.
      type: Boolean
    - contextPath: EWS.User.LastName
      description: Last name of the user object.
      type: String
    - contextPath: EWS.User.LegacyExchangeDN
      description: Legacy exchange distinguished name of the user object.
      type: String
    - contextPath: EWS.User.LegalAgeGroup
      description: Legal age group of the user object.
      type: Unknown
    - contextPath: EWS.User.LinkedMasterAccount
      description: Linked master account of the user object.
      type: String
    - contextPath: EWS.User.MailboxLocations
      description: Mailbox locations of the user object.
      type: String
    - contextPath: EWS.User.MailboxProvisioningConstraint
      description: Mailbox provisioning constraint of the user object.
      type: Unknown
    - contextPath: EWS.User.MailboxRegion
      description: Mailbox region of the user object.
      type: Unknown
    - contextPath: EWS.User.MailboxRegionLastUpdateTime
      description: Last time the mailbox region  of the user object was updated.
      type: Unknown
    - contextPath: EWS.User.MailboxRegionSuffix
      description: Mailbox region suffix of the user object.
      type: String
    - contextPath: EWS.User.MailboxRelease
      description: Mailbox release of the user object.
      type: String
    - contextPath: EWS.User.MailboxWorkloads
      description: Mailbox workloads of the user object.
      type: String
    - contextPath: EWS.User.Manager
      description: Manager of the user object.
      type: Unknown
    - contextPath: EWS.User.MicrosoftOnlineServicesID
      description: Microsoft Online Services ID of the user object.
      type: String
    - contextPath: EWS.User.MobilePhone
      description: Mobile phone of the user object.
      type: String
    - contextPath: EWS.User.Name
      description: Name of the user object.
      type: String
    - contextPath: EWS.User.NetID
      description: Network ID of the user object.
      type: String
    - contextPath: EWS.User.Notes
      description: Notes for the user object.
      type: String
    - contextPath: EWS.User.ObjectCategory
      description: Object category of the user object.
      type: String
    - contextPath: EWS.User.ObjectClass
      description: Object class of the user object.
      type: String
    - contextPath: EWS.User.ObjectState
      description: Object state of the user object.
      type: String
    - contextPath: EWS.User.Office
      description: Office of the user object.
      type: String
    - contextPath: EWS.User.OrganizationId
      description: Organization ID of the user object.
      type: String
    - contextPath: EWS.User.OrganizationalUnit
      description: Organizational unit of the user object.
      type: String
    - contextPath: EWS.User.OriginatingServer
      description: Originating server of the user object.
      type: String
    - contextPath: EWS.User.PSComputerName
      description: PowerShell computer name of the user object.
      type: String
    - contextPath: EWS.User.PSShowComputerName
      description: Whether to show the PowerShell computer name of the user object.
      type: Boolean
    - contextPath: EWS.User.Pager
      description: Pager of the user object.
      type: String
    - contextPath: EWS.User.Phone
      description: Phone of the user object.
      type: String
    - contextPath: EWS.User.PhoneticDisplayName
      description: Phonetic display name of the user object.
      type: String
    - contextPath: EWS.User.PostalCode
      description: Postal Code of the user object.
      type: String
    - contextPath: EWS.User.PreviousRecipientTypeDetails
      description: Details of the previous recipient type of the user object.
      type: String
    - contextPath: EWS.User.RecipientType
      description: Recipient type of the user object.
      type: String
    - contextPath: EWS.User.RecipientTypeDetails
      description: Details of the recipient type of the user object.
      type: String
    - contextPath: EWS.User.RemotePowerShellEnabled
      description: Whether remote PowerShell is enabled for the user object.
      type: Boolean
    - contextPath: EWS.User.ResetPasswordOnNextLogon
      description: Whether to reset the password on next logon.
      type: Boolean
    - contextPath: EWS.User.RunspaceId
      description: Runspace ID of the user object.
      type: String
    - contextPath: EWS.User.SKUAssigned
      description: Whether SKU is assigned.
      type: Boolean
    - contextPath: EWS.User.SamAccountName
      description: sAMAccountName of the user object.
      type: String
    - contextPath: EWS.User.SeniorityIndex
      description: Seniority index of the user object.
      type: Unknown
    - contextPath: EWS.User.Sid
      description: SID of the user object.
      type: String
    - contextPath: EWS.User.SimpleDisplayName
      description: Simple display name of the user object.
      type: String
    - contextPath: EWS.User.StateOrProvince
      description: State or province of the user object.
      type: String
    - contextPath: EWS.User.StreetAddress
      description: Street address of the user object.
      type: String
    - contextPath: EWS.User.StsRefreshTokensValidFrom
      description: The validation start date for the Security Token Service (STS) refresh tokens of the user object.
      type: Date
    - contextPath: EWS.User.TelephoneAssistant
      description: Telephone assistant of the user object.
      type: String
    - contextPath: EWS.User.Title
      description: Title of the user object.
      type: String
    - contextPath: EWS.User.UMDialPlan
      description: Unified Messaging (UM) dial plan of the user object.
      type: Unknown
    - contextPath: EWS.User.UMDtmfMap
      description: Unified Messaging (UM) dual tone multi-frequency (DTMF) map of the user object.
      type: String
    - contextPath: EWS.User.UpgradeDetails
      description: Upgrade details of the user object.
      type: Unknown
    - contextPath: EWS.User.UpgradeMessage
      description: Upgrade message of the user object.
      type: Unknown
    - contextPath: EWS.User.UpgradeRequest
      description: Upgrade request of the user object.
      type: String
    - contextPath: EWS.User.UpgradeStage
      description: Upgrade stage of the user object.
      type: Unknown
    - contextPath: EWS.User.UpgradeStageTimeStamp
      description: Upgrade stage time stamp of the user object.
      type: Unknown
    - contextPath: EWS.User.UpgradeStatus
      description: Upgrade status of the user object.
      type: String
    - contextPath: EWS.User.UserAccountControl
      description: User account control of the user object.
      type: String
    - contextPath: EWS.User.UserPrincipalName
      description: User principal name of the user object.
      type: String
    - contextPath: EWS.User.WebPage
      description: Web page of the user object.
      type: String
    - contextPath: EWS.User.WhenChanged
      description: The date the user object was changed.
      type: Date
    - contextPath: EWS.User.WhenChangedUTC
      description: The date in UTC format of when the user object was changed.
      type: Date
    - contextPath: EWS.User.WhenCreated
      description: The date the user object was created.
      type: Date
    - contextPath: EWS.User.WhenCreatedUTC
      description: The date in UTC format of when the user object was created.
      type: Date
    - contextPath: EWS.User.WhenSoftDeleted
      description: When the user object was soft deleted.
      type: Unknown
    - contextPath: EWS.User.WindowsEmailAddress
      description: Windows email address of the user object.
      type: String
    - contextPath: EWS.User.WindowsLiveID
      description: Windows live ID of the user object.
      type: String
    - contextPath: EWS.User.DirectReports
      description: Direct reports of the user object.
      type: String
  - arguments:
    - description: The mailbox you want to view.
      name: identity
    - description: The domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN). This argument is available only in on-premises Exchange.
      name: domain_controller
    - defaultValue: 10
      description: Maximum number of users to get. A value of 0 means to get all users.
      name: limit
    description: Retrieves information about the AuditBypassEnabled property value for user accounts (on-premises Exchange and the cloud) and computer accounts (on-premises Exchange only).
    name: ews-mailbox-audit-bypass-association-list
    outputs:
    - contextPath: EWS.MailboxAuditBypassAssociation.AuditBypassEnabled
      description: Whether the mailbox audit bypass association is enabled.
      type: Boolean
    - contextPath: EWS.MailboxAuditBypassAssociation.DistinguishedName
      description: Distinguished name of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ExchangeObjectId
      description: Exchange object ID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ExchangeVersion
      description: The version of the exchanged server.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.Guid
      description: The GUID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.Id
      description: ID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.Identity
      description: The unique identity of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.IsValid
      description: Whether the mailbox audit bypass association property is enabled.
      type: Boolean
    - contextPath: EWS.MailboxAuditBypassAssociation.Name
      description: Name of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ObjectCategory
      description: Object category of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ObjectClass
      description: Object class of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ObjectId
      description: Object ID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.ObjectState
      description: Object state of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.OrganizationId
      description: Organization ID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.OriginatingServer
      description: Originating server of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.PSComputerName
      description: PowerShell computer name of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.PSShowComputerName
      description: Whether to show the computer name of the mailbox audit bypass association.
      type: Boolean
    - contextPath: EWS.MailboxAuditBypassAssociation.RunspaceId
      description: Runspace ID of the mailbox audit bypass association.
      type: String
    - contextPath: EWS.MailboxAuditBypassAssociation.WhenChanged
      description: The date the mailbox audit bypass association was changed.
    - contextPath: EWS.MailboxAuditBypassAssociation.WhenChangedUTC
      description: The date in UTC of when the mailbox audit bypass association was changed.
      type: Date
    - contextPath: EWS.MailboxAuditBypassAssociation.WhenCreated
      description: The date the mailbox audit bypass association was created.
      type: Date
    - contextPath: EWS.MailboxAuditBypassAssociation.WhenCreatedUTC
      description: The date in UTC format of when the mailbox audit bypass association was created.
      type: Date
  - name: ews-export-quarantinemessage
    arguments:
    - name: identities
      description: A comma-separated list of identities of the messages to export.
      isArray: true
    - name: identity
      description: The identity of a single message to export.
    - name: compress_output
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether the output should be compressed.
    - name: entity_type
      auto: PREDEFINED
      predefined:
      - Email
      - SharePointOnline
      - Teams
      - DataLossPrevention
      description: The type of entity being exported.
    - name: force_conversion_to_mime
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to force conversion to MIME format.
    - name: password
      description: Password to encrypt the exported file. Using this argument requires 'compress_output' argument to be set to true.
    - name: reason_for_export
      description: Reason for exporting the message. Using this argument requires 'compress_output' argument to be set to true.
    - name: recipient_address
      description: Filters the results by the recipient's email address.
    outputs:
    - contextPath: EWS.ExportQuarantineMessage.BodyEncoding
      description: Encoding used for the body of the message.
      type: string
    - contextPath: EWS.ExportQuarantineMessage.Eml
      description: The email message in Base64 encoding.
      type: string
    - contextPath: EWS.ExportQuarantineMessage.Identity
      description: Unique identifier for the retrieved message.
      type: string
    - contextPath: EWS.ExportQuarantineMessage.Organization
      description: Identifier for the organization associated with the message.
      type: string
    description: Export quarantine messages. Uses PowerShell Export-QuarantineMessage cmdlet.
    execution: true
  - name: ews-get-quarantinemessage
    arguments:
    - name: identity
      description: The identity of a single message to retrieve.
    - name: entity_type
      auto: PREDEFINED
      predefined:
      - Email
      - SharePointOnline
      - Teams
      - DataLossPrevention
      description: Filters by entity workload type.
    - name: recipient_address
      description: Filters by the recipient email address.
    - name: sender_address
      description: Filters by the sender email address.
    - name: teams_conversation_types
      hidden: true
      deprecated: true
      auto: PREDEFINED
      predefined:
      - ResultNotFound
      - OneOnOne
      - GroupChat
      - TeamChat
      - MeetingChat
      - Sms
      description: Filters by one or more Teams conversation types.
      isArray: true
    - name: direction
      auto: PREDEFINED
      predefined:
      - Inbound
      - Outbound
      description: The message direction (inbound or outbound).
    - name: domain
      description: Domain associated with the message.
    - name: end_expires_date
      description: End date for the message expiration.
    - name: end_received_date
      description: The end of the received message date range. Supports the format 'MM/dd/yyyy HH:mm:ss'.
    - name: include_messages_from_blocked_sender_address
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Whether to include messages from blocked sender addresses.
    - name: message_id
      description: The internet message ID (client ID) found in the email headers.
    - name: my_items
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Include only items belonging to the user.
    - name: page
      description: Page number for pagination.
    - name: page_size
      description: The number of items per page. Maximum is 1000.
      defaultValue: '50'
    - name: policy_name
      description: Name of the policy associated with the message.
    - name: policy_types
      auto: PREDEFINED
      predefined:
      - SafeAttachmentPolicy
      - HostedContentFilterPolicy
      - ExchangeTransportRule
      - DataLossPreventionRule
      - AntiMalwarePolicy
      - AntiPhishPolicy
      description: Filter by types of policies.
      isArray: true
    - name: quarantine_types
      auto: PREDEFINED
      predefined:
      - Spam
      - TransportRule
      - Bulk
      - Phish
      - HighConfPhish
      - Malware
      - SPOMalware
      - DataLossPrevention
      - FileTypeBlock
      - AdminTriggered
      - PPI
      description: Filters by one or more quarantine types.
      isArray: true
    - name: recipient_tag
      auto: PREDEFINED
      predefined:
      - "Priority Account"
      description: Filters by the priority tag associated with the recipient.
    - name: release_status
      auto: PREDEFINED
      predefined:
      - Approved
      - Denied
      - Error
      - NotReleased
      - PreparingToRelease
      - Released
      - Requested
      description: Filters by the message release status.
    - name: reported
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Whether to include only reported messages.
    - name: start_expires_date
      description: Start date for the message expiration.
    - name: start_received_date
      description: The start of the received message date range. Supported format  'MM/dd/yyyy HH:mm:ss'.
    - name: subject
      description: Subject of the message.
    - name: type
      description: Type of the message.
    outputs:
    - contextPath: EWS.GetQuarantineMessage.ApprovalId
      description: Approval ID of the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.ApprovalUPN
      description: User Principal Name (UPN) of the approver.
      type: string
    - contextPath: EWS.GetQuarantineMessage.CustomData
      description: Custom data associated with the message.
      type: unknown
    - contextPath: EWS.GetQuarantineMessage.DeletedForRecipients
      description: List of recipients for whom the message was deleted.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Direction
      description: Direction of the message (Inbound/Outbound).
      type: string
    - contextPath: EWS.GetQuarantineMessage.EntityType
      description: Entity type of the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Expires
      description: Expiry date of the message.
      type: date
    - contextPath: EWS.GetQuarantineMessage.Identity
      description: Unique identifier for the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.MessageId
      description: Message ID of the email.
      type: string
    - contextPath: EWS.GetQuarantineMessage.MoveToQuarantineAdminActionTakenBy
      description: Admin action taken by.
      type: string
    - contextPath: EWS.GetQuarantineMessage.MoveToQuarantineApprovalId
      description: Approval ID for moving to quarantine.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Organization
      description: Identifier for the organization associated with the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.OverrideReason
      description: Reason for overriding the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.OverrideReasonIntValue
      description: Integer value of the override reason.
      type: number
    - contextPath: EWS.GetQuarantineMessage.PermissionToAllowSender
      description: Permission to allow the sender.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToBlockSender
      description: Permission to block the sender.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToDelete
      description: Permission to delete the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToDownload
      description: Permission to download the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToPreview
      description: Permission to preview the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToRelease
      description: Permission to release the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToRequestRelease
      description: Permission to request release of the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PermissionToViewHeader
      description: Permission to view the header of the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.PolicyName
      description: Name of the policy applied to the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.PolicyType
      description: Type of the policy applied to the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.QuarantineTypes
      description: Types of quarantine applied to the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.QuarantinedUser
      description: List of users quarantined.
      type: string
    - contextPath: EWS.GetQuarantineMessage.ReceivedTime
      description: Time the message was received.
      type: date
    - contextPath: EWS.GetQuarantineMessage.RecipientAddress
      description: List of recipient email addresses.
      type: string
    - contextPath: EWS.GetQuarantineMessage.RecipientCount
      description: Number of recipients.
      type: number
    - contextPath: EWS.GetQuarantineMessage.RecipientTag
      description: Tags associated with the recipient.
      type: string
    - contextPath: EWS.GetQuarantineMessage.ReleaseStatus
      description: Release status of the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Released
      description: Whether the message was released.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.ReleasedBy
      description: List of users who released the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.ReleasedCount
      description: Number of times the message was released.
      type: number
    - contextPath: EWS.GetQuarantineMessage.ReleasedUser
      description: List of users who released the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Reported
      description: Whether the message was reported.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.SenderAddress
      description: Email address of the sender.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Size
      description: Size of the message in bytes.
      type: number
    - contextPath: EWS.GetQuarantineMessage.SourceId
      description: Source ID of the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Subject
      description: Subject of the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.SystemReleased
      description: Whether the system released the message.
      type: boolean
    - contextPath: EWS.GetQuarantineMessage.TagName
      description: Tag name associated with the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.TeamsConversationType
      description: Teams conversation type associated with the message.
      type: string
    - contextPath: EWS.GetQuarantineMessage.Type
      description: Type of the message.
      type: string
    description: Retrieve quarantine messages. Uses PowerShell Get-QuarantineMessage cmdlet.
    execution: true
  - name: ews-release-quarantinemessage
    arguments:
    - name: user
      description: The email address of the user you want to release the quarantined message to.
    - name: identities
      description: A comma-separated list of identities of the messages to release.
      isArray: true
    - name: identity
      description: The identity of a single message to release.
    - name: release_to_all
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to release the message to all recipients.
    - name: allow_sender
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to allow the sender.
    - name: entity_type
      auto: PREDEFINED
      predefined:
      - Email
      - SharePointOnline
      - Teams
      - DataLossPrevention
      description: The entity workload type being released.
    - name: force
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to force the release.
    - name: report_false_positive
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      description: Specify whether to report the message as a false positive.
    - name: action_type
      auto: PREDEFINED
      predefined:
      - Release
      - Deny
      - Request
      description: The action to perform on the quarantined message.
      defaultValue: 'Release'
    description: Releases the quarantined messages. Uses the PowerShell Release-QuarantineMessage cmdlet.
    execution: true
  - name: ews-remove-tenant-allow-block-list-items
    arguments:
    - name: entries
      description: Entries to remove from the list.  Either use this OR 'ids' to specify items to remove.  Separate multiple entries with a comma (e.g. "Item1,Item2").
      isArray: true
    - name: ids
      description: Entry IDs to remove from the list.  Either use this OR 'entries' to specify items to remove.  Separate multiple entries with a comma (e.g. "Item1,Item2").
    - name: list_type
      required: true
      auto: PREDEFINED
      predefined:
      - sender
      - filehash
      - url
      description: List type to remove items from.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List subtype to remove items from.
      defaultValue: Tenant
    outputs:
    - contextPath: EWS.RemovedTenantBlocks.Action
      description: Action.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.EntryValueHash
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Error
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ExpirationDate
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Identity
      description: Blank for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.LastModifiedDateTime
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ListSubType
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ModifiedBy
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Notes
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ObjectState
      description: State of the object (Deleted).
      type: string
    - contextPath: EWS.RemovedTenantBlocks.PSComputerName
      description: Name of Remote Powershell endpoint.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.PSShowComputerName
      description: Flag whether or not remote computer name is shown in PS prompt.
      type: boolean
    - contextPath: EWS.RemovedTenantBlocks.RunspaceId
      description: RunspaceID of the entry.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.SubmissionID
      description: SubmissionID of the entry.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.SysManaged
      description: SysManaged property of the entry.
      type: boolean
    - contextPath: EWS.RemovedTenantBlocks.Value
      description: The value of the entry that was removed.
      type: string
    description: Remove items from the tenant's Allow/Block Lists. You can delete items by their value or by their unique ID. Uses the PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.
  - name: ews-email-security-unblock-sender-office-365-quick-action
    prettyname: "[Email Security] Unblock Sender - Office 365"
    quickaction: true
    hidden: true
    arguments:
    - name: entries
      required: true
      description: Entries to remove from the list.  Either use this OR 'ids' to specify items to remove.  Separate multiple entries with a comma (e.g. "Item1,Item2").
      isArray: true
      prettyname: Email Sender
      prettypredefined:
        Issue email sender: ${issue.xdmemailsender}
    - name: ids
      description: Entry IDs to remove from the list.  Either use this OR 'entries' to specify items to remove.  Separate multiple entries with a comma (e.g. "Item1,Item2").
    - name: list_type
      defaultValue: sender
      description: List type to remove items from.
    - name: list_subtype
      auto: PREDEFINED
      predefined:
      - Tenant
      - AdvancedDelivery
      - Submission
      description: List the subtype to remove items from.
      defaultValue: Tenant
    outputs:
    - contextPath: EWS.RemovedTenantBlocks.Action
      description: Action.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.EntryValueHash
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Error
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ExpirationDate
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Identity
      description: Blank for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.LastModifiedDateTime
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ListSubType
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ModifiedBy
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.Notes
      description: Null for deleted items.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.ObjectState
      description: State of the object (Deleted).
      type: string
    - contextPath: EWS.RemovedTenantBlocks.PSComputerName
      description: Name of Remote Powershell endpoint.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.PSShowComputerName
      description: Flag whether or not remote computer name is shown in PS prompt.
      type: boolean
    - contextPath: EWS.RemovedTenantBlocks.RunspaceId
      description: RunspaceID of the entry.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.SubmissionID
      description: SubmissionID of the entry.
      type: string
    - contextPath: EWS.RemovedTenantBlocks.SysManaged
      description: SysManaged property of the entry.
      type: boolean
    - contextPath: EWS.RemovedTenantBlocks.Value
      description: The value of the entry that was removed.
      type: string
    description: Remove items from the Tenant's Allow/Block Lists. You can delete items by their value or by their unique ID. Uses the PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.
  - name: ews-rule-list
    arguments:
    - name: mailbox
      description: The mailbox that contains the Inbox rule.
      required: true
    - defaultValue: 50
      description: Maximum number of rules to get. A value of 0 means to get all rules.
      name: limit
    outputs:
    - contextPath: EWS.Rule.RuleIdentity
      description: The rule identity.
      type: string
    - contextPath: EWS.Rule.Name
      description: The rule name.
      type: string
    - contextPath: EWS.Rule.Enabled
      description: Whether the rule is enabled or not.
      type: string
    - contextPath: EWS.Rule.Priority
      description: The priorty of the rule.
      type: string
    description: Retrieve a list of an Inbox rules.
  - name: ews-get-rule
    arguments:
    - name: mailbox
      description: The mailbox that contains the Inbox rule.
      required: true
    - name: identity
      description: The Inbox rule that you want to view.
      required: true
    outputs:
    - contextPath: EWS.Rule.Rule
      description: The rule identity.
      type: string
    - contextPath: EWS.Rule.RuleName
      description: The rule name.
      type: string
    - contextPath: EWS.Rule.IsEnabled
      description: Whether the rule is enabled or not.
      type: boolean
    - contextPath: EWS.Rule.Priority
      description: The priorty of the rule.
      type: string
    - contextPath: EWS.Rule.Description
      description: The description of the rule.
      type: string
    - contextPath: EWS.Rule.StopProcessingRules
      description: Stop Processing Rules.
      type: string
    - contextPath: EWS.Rule.IsValid
      description: Whether the rule is valid or not.
      type: boolean
    description: Retrieve information about the Inbox rule properties.
  - name: ews-remove-rule
    arguments:
    - name: mailbox
      description: The mailbox that contains the Inbox rule.
      required: true
    - name: identity
      description: The Inbox rule that you want to remove.
      required: true
    description: Remove an Inbox rule.
  - name: ews-rule-disable
    arguments:
    - name: mailbox
      description: The mailbox that contains the inbox rule.
      required: true
    - name: identity
      description: The inbox rule that you want to disable.
      required: true
    description: Disable an existing inbox rule in a given mailbox.
  - name: ews-rule-enable
    arguments:
    - name: mailbox
      description: The mailbox that contains the inbox rule.
      required: true
    - name: identity
      description: The inbox rule that you want to enable.
      required: true
    description: Enable an existing inbox rule in a given mailbox.
  - name: ews-mail-flow-rules-list
    arguments:
    - name: extended_output
      description: Determine whether the output will be in verbose format or not.
      required: false
      defaultValue: false
    - name: limit
      description: The maximum number of results to retrieve. Default is 1000.
      required: false
      defaultValue: '1000'
    outputs:
    - contextPath: EWS.MailFlowRule.Size
      description: The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
      type: Number
    - contextPath: EWS.MailFlowRule.ExpiryDate
      description: The date and time when the mail flow rule is set to expire and no longer apply.
      type: Date
    - contextPath: EWS.MailFlowRule.Mode
      description: The operational mode of the rule, indicating whether it is active (`Enforce`), in testing mode (`Test`), or disabled.
      type: string
    - contextPath: EWS.MailFlowRule.Quarantine
      description: Specifies whether the rule actions include quarantining messages that match the rule.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Guid
      description: The Globally Unique Identifier for the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.OrganizationId
      description: The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
      type: string
    - contextPath: EWS.MailFlowRule.DistinguishedName
      description: The distinguished name of the mail flow rule in the Exchange directory structure.
      type: string
    - contextPath: EWS.MailFlowRule.IsValid
      description: Indicates whether the mail flow rule is valid and functional.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Conditions
      description: The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Comments
      description: Free-form text field for adding comments or notes about the rule, typically used for documentation.
      type: Unknown
    - contextPath: EWS.MailFlowRule.WhenChanged
      description: The date and time when the mail flow rule was last modified.
      type: Date
    - contextPath: EWS.MailFlowRule.Description
      description: A brief description of the mail flow rule's purpose or functionality.
      type: string
    - contextPath: EWS.MailFlowRule.Actions
      description: The actions taken when a message matches the rule's conditions, such as redirecting, blocking, or adding headers.
      type: Unknown
    - contextPath: EWS.MailFlowRule.ImmutableId
      description: A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Identity
      description: The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
      type: string
    - contextPath: EWS.MailFlowRule.Name
      description: The user-friendly name of the mail flow rule, typically used for easy identification.
      type: string
    - contextPath: EWS.MailFlowRule.CreatedBy
      description: The user or process that created the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.RouteMessageOutboundConnector
      description: Specifies whether messages matching the rule should be routed through a specific outbound connector.
      type: Unknown
    description: List all mail flow rules (transport rules) in the organization.
  - name: ews-mail-flow-rule-get
    arguments:
    - name: identity
      description: The rule that you want to view.
      required: true
    - name: extended_output
      description: Determine whether the output will be in verbose format or not.
      required: false
      defaultValue: false
    outputs:
    - contextPath: EWS.MailFlowRule.Size
      description: The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
      type: Number
    - contextPath: EWS.MailFlowRule.ExpiryDate
      description: The date and time when the mail flow rule is set to expire and no longer apply.
      type: Date
    - contextPath: EWS.MailFlowRule.Mode
      description: The operational mode of the rule, indicating whether it is active (`Enforce`), in testing mode (`Test`), or disabled.
      type: string
    - contextPath: EWS.MailFlowRule.Quarantine
      description: Specifies whether the rule actions include quarantining messages that match the rule.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Guid
      description: The unique identifier (Globally Unique Identifier) for the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.OrganizationId
      description: The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
      type: string
    - contextPath: EWS.MailFlowRule.DistinguishedName
      description: The distinguished name of the mail flow rule in the Exchange directory structure.
      type: string
    - contextPath: EWS.MailFlowRule.IsValid
      description: Indicates whether the mail flow rule is valid and functional.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Conditions
      description: The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Comments
      description: Free-form text field for adding comments or notes about the rule, typically used for documentation.
      type: Unknown
    - contextPath: EWS.MailFlowRule.WhenChanged
      description: The date and time when the mail flow rule was last modified.
      type: Date
    - contextPath: EWS.MailFlowRule.Description
      description: A brief description of the mail flow rule's purpose or functionality.
      type: string
    - contextPath: EWS.MailFlowRule.Actions
      description: The actions taken when a message matches the rule's conditions, such as redirecting, blocking, or adding headers.
      type: Unknown
    - contextPath: EWS.MailFlowRule.ImmutableId
      description: A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Identity
      description: The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
      type: string
    - contextPath: EWS.MailFlowRule.Name
      description: The user-friendly name of the mail flow rule, typically used for easy identification.
      type: string
    - contextPath: EWS.MailFlowRule.CreatedBy
      description: The user or process that created the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.RouteMessageOutboundConnector
      description: Specifies whether messages matching the rule should be routed through a specific outbound connector.
      type: Unknown
    description: Get a mail flow rule (transport rules) in the organization.
  - name: ews-mail-flow-rule-remove
    arguments:
    - name: identity
      description: The rule that you want to remove.
      required: true
    description: Remove a mail flow rule (transport rule) from the organization.
  - name: ews-mail-flow-rule-disable
    arguments:
    - name: identity
      description: The rule that you want to disable.
      required: true
    description: Disable a mail flow rule (transport rule) in the organization.
  - name: ews-mail-flow-rule-enable
    arguments:
    - name: identity
      description: The rule that you want to enable.
      required: true
    description: Enable a mail flow rule (transport rule) in the organization.
  - name: ews-mail-flow-rule-create
    arguments:
    - name: name
      description: The unique name of the rule. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks ("). A name must always be provided, either through this argument or as a `Name` key inside the entry_id file. If both are provided, the value from the entry_id file takes precedence.
      required: false
    - name: mode
      description: How the rule operates.
      required: false
      auto: PREDEFINED
      predefined:
      - Audit
      - AuditAndNotify
      - Enforce
    - name: priority
      description: The priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
      required: false
    - name: from
      description: 'A comma-separated list of senders to look for in messages. You can use any value that uniquely identifies the sender, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks ("). For example, to search for a sender with the name Chris and the alias Tech Writer, use the following syntax: Chris,"Tech Writer".'
      required: false
      isArray: true
    - name: sent_to
      description: 'A comma-separated list of recipients to look for in messages. You can use any value that uniquely identifies the recipient, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks ("). For example, to search for a recipient with the name Chris and the alias Tech Writer, use the following syntax: Chris,"Tech Writer".'
      required: false
      isArray: true
    - name: subject_contains_words
      description: 'A comma-separated list of words or phrases to look for in the Subject field of messages. If a value contains spaces, as with a phrase, enclose it in quotation marks ("). For example: Word1,"Phrase with spaces",word2.'
      required: false
    - name: except_if_subject_contains_words
      description: 'A comma-separated list of words or phrases that, when found in the Subject field of messages, exempt the message from the rule. If a value contains spaces, as with a phrase, enclose it in quotation marks ("). For example: Word1,"Phrase with spaces",word2.'
      required: false
    - name: reject_message_reason_text
      description: The explanation text that's used when the rule rejects messages. If the value contains spaces, enclose the value in quotation marks ("). When no entry_id file is provided, at least one of the actions (`reject_message_reason_text`, `quarantine`, or `delete_message`) must be provided.
      required: false
    - name: quarantine
      description: Whether to quarantine messages that match the rule. When no entry_id file is provided, at least one of the actions (`reject_message_reason_text`, `quarantine`, or `delete_message`) must be provided.
      required: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: delete_message
      description: Whether to silently drop messages without an NDR. When no entry_id file is provided, at least one of the actions (`reject_message_reason_text`, `quarantine`, or `delete_message`) must be provided.
      required: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: comments
      description: The descriptive text for the rule (for example, what the rule is used for, or how it has changed over time).
      required: false
    - name: entry_id
      description: 'The War Room entry ID of a JSON file that contains additional rule parameters as a map of parameter name to value (for example, {"Name": "My rule", "ActivationDate": "09/01/2018"}). Use this to set parameters that are not exposed as dedicated command arguments. Values in the file take precedence over the corresponding command arguments. If the `name` argument is not provided, the file must include a `Name` key.'
      required: false
    - name: extended_output
      description: Whether the output will be in verbose format.
      required: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: false
    description: 'Create a transport rule (mail flow rule) in the organization. A name must always be provided, either through the `name` argument or as a `Name` key inside the entry_id file. When no entry_id file is provided, both the `name` argument and at least one action (`reject_message_reason_text`, `quarantine`, or `delete_message`) are required.'
    outputs:
    - contextPath: EWS.MailFlowRule.Size
      description: The size of the mail flow rule in bytes, typically related to the storage or data usage of the rule.
      type: Number
    - contextPath: EWS.MailFlowRule.ExpiryDate
      description: The date and time when the mail flow rule is set to expire and no longer apply (e.g., 2024-01-15T12:34:56Z).
      type: Date
    - contextPath: EWS.MailFlowRule.Mode
      description: The operational mode of the rule, indicating whether it is active (`Enforce`), in testing mode (`Test`), or disabled.
      type: string
    - contextPath: EWS.MailFlowRule.Quarantine
      description: Specifies whether the rule actions include quarantining messages that match the rule.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Guid
      description: The Globally Unique Identifier for the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.OrganizationId
      description: The identifier for the organization where the mail flow rule is configured, typically used in multi-tenant environments.
      type: string
    - contextPath: EWS.MailFlowRule.DistinguishedName
      description: The distinguished name of the mail flow rule in the Exchange directory structure.
      type: string
    - contextPath: EWS.MailFlowRule.IsValid
      description: Indicates whether the mail flow rule is valid and functional.
      type: Boolean
    - contextPath: EWS.MailFlowRule.Conditions
      description: The conditions that trigger the mail flow rule, such as specific senders, recipients, or message properties.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Comments
      description: Free-form text field for adding comments or notes about the rule, typically used for documentation.
      type: Unknown
    - contextPath: EWS.MailFlowRule.WhenChanged
      description: The date and time when the mail flow rule was last modified (e.g., 2024-01-15T12:34:56Z).
      type: Date
    - contextPath: EWS.MailFlowRule.Description
      description: A brief description of the mail flow rule's purpose or functionality.
      type: string
    - contextPath: EWS.MailFlowRule.Actions
      description: The actions taken when a message matches the rule's conditions, such as redirecting, blocking, or adding headers.
      type: Unknown
    - contextPath: EWS.MailFlowRule.ImmutableId
      description: A persistent, unchangeable identifier for the mail flow rule, ensuring it remains identifiable across modifications.
      type: Unknown
    - contextPath: EWS.MailFlowRule.Identity
      description: The identity of the rule, often combining the name and unique identifiers, used to reference the rule programmatically.
      type: string
    - contextPath: EWS.MailFlowRule.Name
      description: The user-friendly name of the mail flow rule, typically used for easy identification.
      type: string
    - contextPath: EWS.MailFlowRule.CreatedBy
      description: The user or process that created the mail flow rule.
      type: string
    - contextPath: EWS.MailFlowRule.RouteMessageOutboundConnector
      description: Specifies whether messages matching the rule should be routed through a specific outbound connector.
      type: Unknown
  - name: ews-mail-flow-rule-update
    arguments:
    - name: identity
      description: 'The rule that you want to modify. You can use any value that uniquely identifies the rule, such as a name, distinguished name, or GUID. An identity must always be provided, either through this argument or as an `Identity` key inside the entry_id file. If both are provided, the value from the entry_id file takes precedence.'
      required: false
    - name: mode
      description: How the rule operates.
      required: false
      auto: PREDEFINED
      predefined:
      - Audit
      - AuditAndNotify
      - Enforce
    - name: priority
      description: The priority value for the rule that determines the order of rule processing. A lower integer value indicates a higher priority, the value 0 is the highest priority, and rules can't have the same priority value.
      required: false
    - name: from
      description: 'A comma-separated list of senders to look for in messages. You can use any value that uniquely identifies the sender, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks ("). For example, to search for a sender with the name Chris and the alias Tech Writer, use the following syntax: Chris,"Tech Writer".'
      required: false
      isArray: true
    - name: sent_to
      description: 'A comma-separated list of recipients to look for in messages. You can use any value that uniquely identifies the recipient, such as a name, alias, distinguished name, canonical DN, email address, or GUID. If a value contains spaces, enclose it in quotation marks ("). For example, to search for a recipient with the name Chris and the alias Tech Writer, use the following syntax: Chris,"Tech Writer".'
      required: false
      isArray: true
    - name: subject_contains_words
      description: 'A comma-separated list of words or phrases to look for in the Subject field of messages. If a value contains spaces, as with a phrase, enclose it in quotation marks ("). For example: Word1,"Phrase with spaces",word2.'
      required: false
    - name: except_if_subject_contains_words
      description: 'A comma-separated list of words or phrases that, when found in the Subject field of messages, exempt the message from the rule. If a value contains spaces, as with a phrase, enclose it in quotation marks ("). For example: Word1,"Phrase with spaces",word2.'
      required: false
    - name: reject_message_reason_text
      description: The explanation text that's used when the rule rejects messages. If the value contains spaces, enclose the value in quotation marks (").
      required: false
    - name: quarantine
      description: Whether to quarantine messages that match the rule.
      required: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: delete_message
      description: Whether to silently drop messages without an NDR.
      required: false
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: comments
      description: The descriptive text for the rule (for example, what the rule is used for, or how it has changed over time).
      required: false
    - name: entry_id
      description: 'The War Room entry ID of a JSON file that contains additional rule parameters as a map of parameter name to value (for example, {"Identity": "My rule", "ActivationDate": "09/01/2018"}). Use this to set parameters that are not exposed as dedicated command arguments. Values in the file take precedence over the corresponding command arguments. If the `identity` argument is not provided, the file must include an `Identity` key.'
      required: false
    description: 'Modify an existing transport rule (mail flow rule) in the organization. An identity must always be provided, either through the `identity` argument or as an `Identity` key inside the entry_id file. When no entry_id file is provided, the `identity` argument is required.'
  - name: ews-mail-forwarding-disable
    arguments:
    - name: identity
      description: The mailbox that you want to modify.
      required: true
    description: Disable mail forwarding for a given user.
  script: ''
  type: powershell
  dockerimage: demisto/pwsh-exchangev3:1.0.0.11550820
fromversion: 5.5.0
supportsquickactions: true
tests:
- playbook-O365-EWS-Extension-Powershell-Online-V3-Test