O365 Message Trace
Message Trace enables tenant administrators to track the lifecycle of an email, determine its delivery status (delivered, pending, failed, or quarantined), and understand the actions applied to it.
- Category
- Analytics & SIEM
- Pack
- MicrosoftExchangeOnline
Configuration parameters
- url — Server URL (required)
- tenant_id — Tenant ID
- credentials_client_id —
- credentials —
- creds_certificate — Certificate Thumbprint
- redirect_uri — Application redirect URI
- auth_code —
- use_managed_identities — Use Azure Managed Identities
- managed_identities_client_id —
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- max_fetch — Maximum number of events per fetch
- isFetchEvents — Fetch Events
- eventFetchInterval — Events Fetch Interval
Commands (4)
- o365-message-trace-auth-reset — Clears the saved access token / refresh token from the integration context, so on the next run a fresh authorization code (or client-credentials token) is requested. Used to rerun the authentication process.
- o365-message-trace-auth-test — Tests connectivity to Microsoft.
- o365-message-trace-generate-login-url — Generates the login URL for the authorization code flow.
- o365-message-trace-get-events — Retrieves Exchange Online Message Trace events. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.