Skip to content
PowerShell module for querying mail activities
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


PowerShell module for querying mail activities.

With this PowerShell module, you can query user's Exchange Online mail activities using an undocumented ActivityAccess API. The API allows access to a log which stores activities for longer time than the "official" activity logs. This helps organisations to perform forensic activities in case of data breach or malware attacks.

This version uses 1.0 API with basic authentication. Therefore the user running queries requires FullAccess to target mailboxes.


There are two cmdlets in the module; Get-MailActivity and Get-MailActivityDetails


This cmdlet queries given user's Exchange Online Mail Activity log using "hidden" ActivityAccess API.

# Save credentials to a variable

# Query for the first 500 mail logins of a user
Get-MailActivity -Credentials $cred -User "" -MaxResult 500 -ActivityType ServerLogon
# Query for the next 500 mail logins of a user
Get-MailActivity -MaxResult 500 -StartFrom 500 -ActivityType ServerLogon


This cmdlet queries message details from given user's Exchange Online mailbox using Outlook API.

# Get delivered messages and message details 
$Activities=Get-MailActivity -Credentials $cred -User "" -MaxResult 500 -ActivityType MessageDelivered
Get-MailActivityDetails -ActivityItemId $Activities[0].ActivityItemId -IncludeBody


The module is based on the research of CrowdStrike.


Copyright (c) 2018 Gerenios / Nestori Syynimaa. See LICENSE for further details.

You can’t perform that action at this time.