Switch branches/tags
Nothing to show
Find file History
Latest commit abfe065 Aug 9, 2018
Failed to load latest commit information.
README.md Update README.md Aug 9, 2018
activities.py Adding O365 tools Jun 19, 2018
requirements.txt Adding O365 tools Jun 19, 2018
retriever.py Fixed typo Jun 29, 2018




Access to the Activities API has been restricted by Microsoft. Accordingly, there are no plans to develop this tool any further.


This tool leverages the Office 365 Outlook Activities API. It will continuously fetch and write activities to a CSV file until all activities matching the specified criteria have been retrieved.


This tool supports all versions of Python 3.


  • requests


Download activities.py and retriever.py.

Access token

This tool requires a valid OAuth 2.0 access token. For testing purposes, a token can be obtained from the Outlook Dev Center - OAuth Sandbox. Supply the token to the tool by setting an OAUTH_TOKEN environment variable (preferred method) or by including it as a command-line argument.


usage: retriever.py --user <username> --output <filename>
                   [--token <token>] [--start <timestamp>]
             	   [--end <timestamp>] [--types <type> [<type> ...]]
--user <username>			Target user (user principal name)
--output <filename>			CSV output filename
--token <token>				OAuth access token
--start <timestamp>			Start timestamp (ISO 8601)
--end <timestamp>			End timestamp (ISO 8601)
--types <type> [<type> ...]		Space-delimited list of activity types


Example 1: Retrieve MessageDelivered activities that occurred after January 1:

python retriever.py --user victim@contoso.com --output activities.csv --types MessageDelivered --start 2018-01-01T00:00:00Z

Example 2: Retrieve ServerLogon and SearchResult activities that occurred in the month of May:

python retriever.py --user victim@contoso.com --output activities.csv --types ServerLogon SearchResult --start 2018-05-01T00:00:00Z --end 2018-05-31T23:59:59Z

Example 3: Retrieve the entire history of activities for a user. (NOTE: This may take a long time)

python retriever.py --user victim@contoso.com --output activities.csv