Skip to main content

Cyware Orchestrate

Office 365 2.0.0

App Vendor: Microsoft

App Category: Messaging

Connector Version: 2.12.0

API Version: 1.0.0

About App

Microsoft Office 365 includes productivity applications that are part of the Microsoft stack. Microsoft Office 365 is designed to help people and businesses achieve more with innovative Office apps, intelligent cloud services, and world-class security.

The Office 365 app is configured with Orchestrate to perform the following actions:

Action Name

Description

Get Email 

This action retrieves emails from a mailbox.

Delete Email 

This action deletes an email from a mailbox.

Get Delta Link for Folder 

This action returns a delta link for a folder.

Get Delta Results 

This action retrieves delta results from a deltaLink URL or nextLink URL. Delta results are those that have been added, deleted, or updated in a specified folder.

Get Folders 

This action retrieves the folders in a mailbox.

Get Folder ID from Name 

This action retrieves the folder ID for a folder.

Get Email in Time Range 

This action retrieves emails from a mailbox in a specified time range.

Copy Email 

This action copies an email to a destination mailbox.

Move Email 

This action moves an email to a destination mailbox.

Get Attachments from Email 

This action retrieves the attachments from an email and sends the attachments to a local file system for analysis.

Get Unread Email 

This action retrieves unread emails from a folder inbox.

Send Email 

This action sends an email to the recipients.

Get Attachment Properties from Email 

This action retrieves the properties and data of an email attachment.

Configuration Parameters

The following configuration parameters are required for the Office 365 app to communicate with the Office 365 application. The parameters can be configured by creating instances in the app.

Parameter 

Description 

Field Type 

Required/Optional 

Comments 

Client ID 

Enter the application ID that is assigned to your app.

Text

Required

Refer to the portal where you registered the app to find this information.

Client Secret 

Enter the client secret ID that you generated for your app in the app registration portal.

Password

Required

The client's secret ID must be URL-encoded before being sent.

Tenant ID 

Enter the directory Tenant ID of the application in GUID or domain-name format.

Text

Required

For more information on retrieving the configuration parameters and assigning the Microsoft Graph and API permissions, see Register Applications and Assign Permissions for EWS Exchange and Office 365 apps

Action: Get Email

This action retrieves emails from a mailbox.

Action Input Parameters 

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID 

Enter the mailbox ID to retrieve emails.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Message ID 

Enter the email message ID. 

Example: 

AAMkADZkZDI2ZmE5LWM4NzQtNGVmMS1iNWFiLWNjOTkzYmU0OGU0ZgBGAAAAAAA9HcHTeTXRRKiEpaoeal9GBwCFJpWbJEOtTL_SCL7x9QBqAAAAAAEMAACFJpWbJEOtTL_SCL7x9QBqAAHAxddYAAA=

Text

Optional

To retrieve this, use the Get Email action along with the Mailbox ID to obtain all the available message IDs.

Folder ID 

Enter the folder ID to retrieve the emails.

Example:

amkagq3ngu3zwq2lwm0

Text

Optional

If no folder is provided, all emails in the account will be returned

Limit 

Enter the maximum number of emails to be returned.

Example:

200

Integer

Optional

Default value:

1000

The API maximum is 1000.

Get Headers 

Choose to retrieve email headers along with the email.

Example:

true

Boolean

Optional

Retrieving email headers impacts the performance of this action.

Default value:

false

Allowed values:

  • true

  • false

Example Request 

[
  {
    "limit": "200",
    "mailbox_id": "test@contesco.onmicrosoft.com",
    "message_id": "AAMkADZkZDI2ZmE5LWM4NzQtNGVmMS1iNWFiLWNjOTkzYmU0OGU0ZgBGAAAAAAA9HcHTeTXRRKiEpaoeal9GBwCFJpWbJEOtTL_SCL7x9QBqAAAAAAEMAACFJpWbJEOtTL_SCL7x9QBqAAHAxddYAAA=",
    "get_headers": false
  }
]
Action: Delete Email

This action deletes an email from the Office 365 Outlook application.

Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID

Enter the mailbox ID to retrieve an email.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Email ID

Enter the ID of an email you need to delete.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2i

xltgwnwflmjzjnxxxxgaaaaaabzhv0qo5xpsop

6gzzf6k5gbwdxxxxx6_qtp45dpzfd_kkaaaaaa

emaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=”

Text

Required

Example Request
[
    {
         “mailbox_id": "test@contesco.onmicrosoft.com",
         “email_id”: “cramkagq3ngu3zwq2lwm0mtitngq4ny
                      04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                      0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                      pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                      d_kkaab76_59aaa=“ 
     }
]
Action: Get Delta Results

This action retrieves delta results from a deltaLink URL or nextLink URL. This is used to retrieve large sets of data in a loop if needed.

Action Input Parameters 

Parameter

Description

Field Type

Required/Optional

Comments

URL 

Enter a deltaLink URL or nextLink URL to retrieve delta results.

Example:

“https://graph.microsoft.com/beta/users/test@conteso.on

microsoft.com/mailfolders('aqmbagz3ngu3awq2lxm0mxxx

xgq4ny04m2ixltgwnwflmjzjndzlmgauaaadc4vdeduv6uqke

hs83_ixxxxx2sk7ayuvke6eoq6cxxfipaaaagemaaaa')/messages

/delta$deltatoken=lztfwwjo5iivxxxxxxaefppquq0uwa2bclcih2v

mkaczs14hfsgsvdaxwwjzi3ywzx81aj2blczqnzdny4defceijlhiig9q

gftyc4ei.j8xvglai6ys6bcrbn2999_zwsytvocafdf5qlj4ofsdx”

Text

Required

 

Example Request 

[
    {
        "url”: “https://graph.microsoft.com/beta/users/test@conteso.on
                microsoft.com/mailfolders('aqmbagz3ngu3awq2lxm0mxxx
                xgq4ny04m2ixltgwnwflmjzjndzlmgauaaadc4vdeduv6uqke
                hs83_ixxxxx2sk7ayuvke6eoq6cxxfipaaaagemaaaa')/messages
                /delta$deltatoken=lztfwwjo5iivxxxxxxaefppquq0uwa2bclcih2v
                mkaczs14hfsgsvdaxwwjzi3ywzx81aj2blczqnzdny4defceijlhiig9q
                gftyc4ei.j8xvglai6ys6bcrbn2999_zwsytvocafdf5qlj4ofsdx”
    }
]
Action: Get Folders

This action retrieves the folders in a mailbox.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID

Enter the mailbox ID to retrieve folders.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Example Request

[
    {
        "mailbox_id": "test@contesco.onmicrosoft.com" 
    }
]
Action: Get Folder ID from Name

This action will attempt to retrieve a folder ID for a given friendly name. By default, it will try to return the ID of the inbox.

Action Input Parameters 

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID 

Enter the mailbox ID to retrieve the folder ID.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

 

Folder Name 

Enter the folder name to retrieve the folder ID.

Example:

“deleted items”, “Inbox”, “Archive”

Text

Optional

 

Example Request 

[
    {
        "mailbox_id": "test@contesco.onmicrosoft.com",
        "folder_name”: "deleted items"    
     }
]
Action: Copy Email

This action copies an email to a destination mailbox.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID

Enter the mailbox ID where the email is located.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Email ID

Enter the ID of an email that you need to copy.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2i

xltgwnwflmjzjnxxxxgaaaaaabzhv0qo5xpsop

6gzzf6k5gbwdxxxxx6_qtp45dpzfd_kkaaaaaa

emaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=”

Text

Required

Destination ID

Enter the destination ID of the folder where you need to copy an email.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgwnwflmjzj

ndzlmgxxxxxaaaabzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_q

tp45dpzfd_kkaaaaaaxxxxxawrtrk6_qtp45dpzfd_kkaab76_59aaa=“

Text

Required

Original folder ID

Enter the ID of folder containing an email that needs to be copied.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndz

lmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d

pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=“

Text

Optional

If the email resides in a sub folder, then the folder ID parameter is mandatory.

Example Request

[
   {
      "mailbox_id":"test@contesco.onmicrosoft.com",
      "email_id":"cramkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtppzfd_kxxxxxaaemaadawrtrk6_qtp4d_kkaab76_59aaa=",
      "destination_id":"gframkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45dpzfd_kxxxxxaaemaadawrtrk6_qtp45dpzd_kkaab76_59aaa=",
      "original_folder_id":"kytramkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45dpzfd_kxxxxxaaemaadawrtrk6_qtp45dpzfd_kkaab76_59aaa="
   }
]

Action: Get Email in Time Range

This action retrieves emails from a mailbox in a specified time range. This will return a maximum of 1000 emails.

Action Input Parameters 

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID 

Enter the mailbox ID to retrieve emails.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

 

From Time 

Enter the start time for the time range to retrieve emails.

Example:

  • “1-10-2021”

  • “3:00 pm”

  • “5 minutes ago”

  • “1646681545” (Unix epoch time format)

Text

Required

 

To Time 

Enter the end time for the time range to retrieve emails. The entered time is not inclusive (less than this time) to retrieve emails.

Example:

  • “1-10-2022”

  • “4:00 pm”

  • “1646681595” (Unix epoch time format)

  • 5 minutes ago

Text

Required

 

Folder ID 

Enter the folder ID to retrieve emails.

Example:

“amkagq3ngu3zwq2lwm0”

Text

Optional

If you do not provide a folder ID, then all emails are returned.

Get Headers 

Choose to retrieve email headers along with the email.

Example:

true

Boolean

Optional

Retrieving email headers impacts the performance of this action.

Default value:

false

Allowed values:

  • true

  • false

Limit 

Enter the maximum number of emails to be returned.

Example:

20

Integer

Optional

The maximum allowed value is 1000.

Default value:

50

Example Request 

[
    {
        "mailbox_id": "test@contesco.onmicrosoft.com",
        "from_time”: “1-10-2021”,   
        “to_time”: “1-10-2022”,   
        "folder_id": "amkagq3ngu3zwq2lw",
        "get_headers": true,
        "limit": 20   
     }
]
Action: Move Email

This action moves an email to a destination mailbox.

Action Input Parameters

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID

Enter the mailbox ID where the email is located.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Email ID

Enter the ID of an email that you need to move.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2i

xltgwnwflmjzjnxxxxgaaaaaabzhv0qo5xpsop

6gzzf6k5gbwdxxxxx6_qtp45dpzfd_kkaaaaaa

emaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=”

Text

Required

Destination ID

Enter the destination ID of the folder where you need to move an email.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgwnwflmjzj

ndzlmgxxxxxaaaabzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_q

tp45dpzfd_kkaaaaaaxxxxxawrtrk6_qtp45dpzfd_kkaab76_59aaa=“

Text

Required

Original folder ID

Enter the ID of folder containing an email that needs to be moved.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndz

lmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d

pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=“

Text

Optional

If the email resides in a sub folder, then the folder ID parameter is mandatory.

Example Request

[
    {
         “mailbox_id": "test@contesco.onmicrosoft.com",
         “email_id”: “cramkagq3ngu3zwq2lwm0mtitngq4ny
                      04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                      0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                      pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                      d_kkaab76_59aaa=“ ,   
         “destination_id": “gframkagq3ngu3zwq2lwm0mtitngq4ny
                            04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                            0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                            pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                            d_kkaab76_59aaa=“ ,
         “original_folder_id": “kytramkagq3ngu3zwq2lwm0mtitngq4ny
                                04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                                0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                                pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                                d_kkaab76_59aaa=“
     }
]
Action: Get Attachments from Email

This action retrieves the attachments from an email and sends the attachments to a local file system for analysis.

Important

It is recommended that the filename length of attachments is less than 100 characters. If the length exceeds 100 characters, then it will be truncated to 100 characters.

Action Input Parameters 

Parameter

Description

Field Type

Required/Optional

Comments

Mailbox ID 

Enter the mailbox ID where the email is present.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Email ID 

Enter the ID of an email whose attachments you need to send to a local file system.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2i

xltgwnwflmjzjnxxxxgaaaaaabzhv0qo5xpsop

6gzzf6k5gbwdxxxxx6_qtp45dpzfd_kkaaaaaa

emaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=”

Text

Required

Folder ID 

Enter the ID of a folder containing the email.

Example:

“aamkagq3ngu3zwq2lwm0mtitngq4ny04m2ixltgxxxxxlmjzjndz

lmgbgaxxxxbzhv0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d

pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzfd_kkaab76_59aaa=“

Text

Optional

If the folder ID is not provided, then all emails are considered.

Get Attachment IDs

Enter true to retrieve the IDs of attachments.

Boolean

Optional

The default value is false.

Example Request 

[
    {
         “mailbox_id": "test@contesco.onmicrosoft.com",
         “email_id”: “cramkagq3ngu3zwq2lwm0mtitngq4ny
                      04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                      0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                      pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                      d_kkaab76_59aaa=“,   
         “folder_id": “kytramkagq3ngu3zwq2lwm0mtitngq4ny
                       04m2ixltgxxxxxlmjzjndzlmgbgaxxxxbzhv
                       0qo5xpsop6gzzf6k5gbwdawrtrk6_qtp45d
                       pzfd_kxxxxxaaemaadawrtrk6_qtp45dpzf
                       d_kkaab76_59aaa=“
         "get_properties": true
     }
]
Action: Get Unread Email

This action retrieves unread emails from a folder inbox. A maximum of 1000 emails are returned.

Action Input Parameters 

Parameter 

Description 

Field Type 

Required/Optional 

Comments 

Mailbox ID 

Enter the mailbox ID to retrieve emails.

Example:

“test@contesco.onmicrosoft.com”

Text

Required

Folder ID 

Enter the folder ID to retrieve the emails.

Example:

“amkagq3ngu3zwq2lwm0”

Text

Optional

If the folder ID is not provided, all the emails in the mailbox are returned.

Get Headers 

Choose to retrieve email headers along with the email.

Example:

true

Boolean

Optional

Retrieving email headers impacts the performance of this action.

Default value:

false

Allowed values:

• true

• false

Mark Mail as Read 

Choose to mark the retrieved emails as read.

Example:

true

Boolean

Optional

Default value:

true

Allowed values:

• true

• false

Limit 

Enter the maximum number of unread emails to retrieve.

Example:

20

Integer

Optional

Default value:

100

Example Request 

[
    {
        "mailbox_id": "test@contesco.onmicrosoft.com",
        "folder_id": "amkagq3ngu3zwq2lwm0",
        "get_headers": true,
        "mark_mail_as_read": false,
        "limit": 20
     }
]
Action: Send Email

This action sends an email to the recipients.

Action Input Parameters 

Parameter 

Description 

Field Type 

Required/Optional 

Comments 

User Email ID  

Enter the user email ID to send the email.

Example:

"systemadmin@1v276d0.onmicrosoft.com"

Text

Required

Body 

Enter the body of the email.

Example:

"The following are the resolutions for the phishing incident"

Text

Optional

To Recipients 

Enter the email ID of the recipients to send the email.

Example:

$LIST[sampleuser@org.com, sampleuser2@org.com]

List

Required

CC Recipients 

A list of email addresses to copy the email. 

Example: 

["testuser1@gmail.com"]

List

Optional

Subject 

Enter the subject of the email.

Example:

"Resolution for phishing incident"

Text

Optional

Attachment File Path 

Enter a list of file paths to retrieve the files and send them with the email.

Example: $LIST[C:/Users/xxxxx/Desktop/phishing_details.txt]

List

Optional

Content Type 

Enter the content type of the email.

Example:

"text/plain"

Text

Optional

Allowed value:

text/plain

Example Request 

[
  {
    "body": "testing",
    "userid": "test@abc.onmicrosoft.com",
    "subject": "Test Mail",
    "cc_recipients": [
      "jane.v@abc.com"
    ],
    "to_recipients": [
      "john.doe@abc.com"
    ]
  }
]
Action: Create Mail

This action creates an email and saves it in a draft folder.

Action Input Parameters 

Parameter 

Description 

Field Type 

Required/Optional 

Comments 

User Email ID 

Enter the user ID to send the email. 

Example: 

"testuser@gmail.com"

Text

Required

 

Body 

Enter the body of the email. 

Example: 

"Hello World"

Text

Required

 

To Recipients 

Enter a list of email addresses to send the email to. 

Example: 

["testuser@gmail.com"] 

List

Required

 

Subject 

Enter the subject of the email. 

Example: 

"Hello World"

Text

Optional

 

Attachment File Path 

Enter a list of file paths to attach to the email. 

Example: 

["C:/Users/xxxxx/Desktop/HelloWorld.txt"]

List

Optional

 

Content Type 

Enter the content type of the email.

Example: 

"text/plain"

Text

Optional

 

Action: Get Attachment Properties from Email

This action retrieves the properties and data of an email attachment.

Action Input Parameters 

Parameter 

Description 

Field Type 

Required/Optional 

Comments 

Mailbox ID 

Enter the mailbox ID to get information from. 

Example: 

test@contesco.onmicrosoft.com

Text

Required

Email ID 

Enter the email ID to get the properties of the attachments.

Example:

AAMkAGQ3NGU3ZWQ2LWM0MTItNGQ4Ny04M7BeOAADawrtrK6_QTp45DpzFd_KkAAB77HojAAA=

Text

Required

You can retrieve this using the action Get Email.

Attachment ID 

Enter the attachment ID to retrieve the properties. 

Example: 

AAMkADA1M-CJKtzmnlcqVgqI=

Text

Required

You can retrieve this using the action Get Attachments from Email.

Folder ID 

Enter the folder ID to look for emails. If no folder is provided, all emails in the account will be returned. 

Example: 

AAMkAGQ3NGU3ZWQ2LWM0MMAADawrtrK6_QTp45DpzFd_KkAAB76_59AAA=

Text

Optional

You can retrieve this using the action Get Folders.

Properties of Attachments 

Enter true to retrieve the properties of the attachments. 

Boolean

Optional

The default value is false.

Example Request 

[
  {
    "email_id": "AAMkADZkZDI2ZmE5LWM4NzQtNGVmMS1iNWFiLWNjOTkzYmU0OGU0ZgBGAAAAAAA9HcHTeTXRRKiEpaoeal9GBwCFJpWbJEOtTL_SCL7x9QBqAAAAAAEMAACFJpWbJEOtTL_SCL7x9QBqAAHAxddcAAA=",
    "mailbox_id": "ctix-test@cywarelabs.onmicrosoft.com",
    "attachment_id": "AAMkADZkZDI2ZmE5LWM4NzQtNGVmMS1iNWFiLWNjOTkzYmU0OGU0ZgBGAAAAAAA9HcHTeTXRRKiEpaoeal9GBwCFJpWbJEOtTL_SCL7x9QBqAAAAAAEMAACFJpWbJEOtTL_SCL7x9QBqAAHAxddcAAABEgAQAC-d3xYNm6BBgItx3fGDg_Q=",
    "get_properties": true
  }
]