Chasing the Unicorn: PowerShell module for 'The Secret Office 365 Forensics Tool'

Chasing the Unicorn: PowerShell module for 'The Secret Office 365 Forensics Tool'

In June 2018 the existence of secret Office 365 forensics tool was confirmed. The tool refers to Microsoft’s undocumented Exchange Online Activities API. The API provides access to a granular mail activity events for up to six months old data!

To provide administrators with easy access to the API, I created a PowerShell module (EXOMailActivity). In this blog, I’ll show you how to use the module to get access to mail activity data.