Queries for the EmailPostDeliveryEvents table
Post-delivery administrator actions
Display post-delivery actions made by Administrator.
EmailPostDeliveryEvents
| where ActionTrigger == 'AdminAction'
| take 100
Unremediated post-delivery phishing email detections
Display post-delivery phishing email detections which was not remediated.
EmailPostDeliveryEvents
| where ActionType == 'Phish ZAP' and ActionResult == 'Error'
| join EmailEvents on NetworkMessageId, RecipientEmailAddress
| take 100
Full email processing details
Emails that include predefined post-delivery actions or automatic rules, by sender and subject.
let mySender = "<insert sender email address>";
let subject = "<insert email subject>";
EmailEvents
| where SenderFromAddress == mySender and Subject == subject
| join EmailPostDeliveryEvents on NetworkMessageId, RecipientEmailAddress
| take 100
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for