Skip to main content


Showing posts from November, 2020

Finding Emails in a Mail Folder older then a specific date using the Microsoft Graph and Powershell

  If you are doing any archiving, clean-up or just searching for Messages that are older then a specific date you will need to make use of a filter on the receivedDateTime. The receivedDateTime property This property represents when the Message was received expressed and stored in UTC time, this means when you query it you should also make sure your query value is in UTC. So for instance if I where looking for all the Email in the JunkEmail folder older then 30 days I could use /v1.0/users('')/MailFolders('JunkEmail')/messages?$Top=10&$filter=receivedDateTime lt 2020-10-21T00:00:00Z If the mailboxes are in a TimeZone other then UTC then first convert the actual date to the local date you want to include to UTC eg in Powershell something like (Get-Date).adddays(-30).Date.ToUniversalTime().ToString("o") This means if my timezone is +11 UTC my actual query time would look like 2020-10-20T13:00:00.0000000Z based on an Actual day value of

Looking at raw Mailbox analytics data using EWS and a ChangeDiscovery script

Mailbox analytics is something Microsoft have been working on for a number of years and its seems to be something that has received a little more effort in these pandemic times. If you have ever looked at the Non_IPM_Subtree of your mailbox you will see a lot of data being stored in their from various apps and substrate processes. A while back i wrote a ChangeDiscovery script to allow me to dump out quick what changes where happening in a Mailbox in a short time frame (eg i wanted to see what happened to all the items in a Mailbox when i performed a specific task). If you run this script with a slightly longer time-frame (eg looking over a day) it picks up all the Items that are being written and created for the Mailbox insights processes and other substrate processes. Most of these emails get written under the  Usually if I then wanted to look at these type of items I would use OutlookSpy or MFCMapi to browse the raw MAPI properties on items to see if they where of interest. Given the
All sample scripts and source code is provided by for illustrative purposes only. All examples are untested in different environments and therefore, I cannot guarantee or imply reliability, serviceability, or function of these programs.

All code contained herein is provided to you "AS IS" without any warranties of any kind. The implied warranties of non-infringement, merchantability and fitness for a particular purpose are expressly disclaimed.