ExchangeMailboxActivity Class

Extends the Common schema with the properties specific to all Exchange mailbox audit data.
Inheritance Hierarchy
SystemObject
  Aspose.Email.Clients.ActivityContent
    Aspose.Email.Clients.ActivityExchangeMailboxActivity

Namespace:  Aspose.Email.Clients.Activity
Assembly:  Aspose.Email (in Aspose.Email.dll) Version: 21.3
Syntax
public class ExchangeMailboxActivity : Content

The ExchangeMailboxActivity type exposes the following members.

Constructors
  NameDescription
Public methodExchangeMailboxActivity
Initializes a new instance of the ExchangeMailboxActivity class
Properties
  NameDescription
Public propertyClientInfoString
Information about the email client that was used to perform the operation, such as a browser version, Outlook version, and mobile device information.
Public propertyClientIP
The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. Mandatory: Yes
(Inherited from Content.)
Public propertyClientIPAddress
The IP address of the device that was used when the operation was logged. The IP address is displayed in either an IPv4 or IPv6 address format.
Public propertyClientMachineName
The machine name that hosts the Outlook client.
Public propertyClientProcessName
The email client that was used to access the mailbox.
Public propertyClientVersion
The version of the email client.
Public propertyCreationTime
The date and time in Coordinated Universal Time (UTC) when the user performed the activity. Mandatory: Yes
(Inherited from Content.)
Public propertyExternalAccess
This is true if the logon user's domain is different from the mailbox owner's domain.
Public propertyId
Unique identifier of an audit record. Mandatory: Yes
(Inherited from Content.)
Public propertyInternalLogonType
Reserved for internal use.
Public propertyLogonType
Indicates the type of user who accessed the mailbox and performed the operation that was logged.
Public propertyLogonUserDisplayName
The user-friendly name of the user who performed the operation.
Public propertyLogonUserSid
The SID of the user who performed the operation.
Public propertyMailboxGuid
The Exchange GUID of the mailbox that was accessed.
Public propertyMailboxOwnerMasterAccountSid
Mailbox owner account's master account SID.
Public propertyMailboxOwnerSid
The SID of the mailbox owner.
Public propertyMailboxOwnerUPN
The email address of the person who owns the mailbox that was accessed.
Public propertyObjectId
For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For Exchange admin audit logging, the name of the object that was modified by the cmdlet. Mandatory: No
(Inherited from Content.)
Public propertyOperation
The name of the user or admin activity. For a description of the most common operations/activities, see Search the audit log in the Office 365 Protection Center. For Exchange admin activity, this property identifies the name of the cmdlet that was run. For Dlp events, this can be "DlpRuleMatch", "DlpRuleUndo" or "DlpInfo", which are described under "DLP schema" below. Mandatory: Yes
(Inherited from Content.)
Public propertyOrganizationId
The GUID for your organization's Office 365 tenant. This value will always be the same for your organization, regardless of the Office 365 service in which it occurs. Mandatory: Yes
(Inherited from Content.)
Public propertyOrganizationName
The name of the tenant.
Public propertyOriginatingServer
This is from where the operation originated.
Public propertyRecordType
The type of operation indicated by the record. Mandatory: Yes
(Inherited from Content.)
Public propertyResultStatus
Indicates whether the action (specified in the Operation property) was successful or not. Possible values are Succeeded, PartiallySucceded, or Failed. For Exchange admin activity, the value is either True or False. Mandatory: No
(Inherited from Content.)
Public propertyScope
Was this event created by a hosted O365 service or an on-premises server? Possible values are online and onprem. Note that SharePoint is the only workload currently sending events from on-premises to O365. Mandatory: No
(Inherited from Content.)
Public propertyUserId
The UPN (User Principal Name) of the user who performed the action (specified in the Operation property) that resulted in the record being logged; for example, my_name@my_domain_name. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included. Mandatory: Yes
(Inherited from Content.)
Public propertyUserKey
An alternative ID for the user identified in the UserId property. For example, this property is populated with the passport unique ID (PUID) for events performed by users in SharePoint, OneDrive for Business, and Exchange. This property may also specify the same value as the UserID property for events occurring in other services and events performed by system accounts. Mandatory: Yes
(Inherited from Content.)
Public propertyUserType
The type of user that performed the operation. Mandatory: Yes
(Inherited from Content.)
Public propertyWorkload
The Office 365 service where the activity occurred in the Workload string. The possible values for this property are: Exchange SharePoint OneDrive AzureActiveDirectory SecurityComplianceCenter Sway ThreatIntelligence Mandatory: No
(Inherited from Content.)
Methods
  NameDescription
Public methodEquals (Inherited from Object.)
Protected methodFinalize (Inherited from Object.)
Public methodGetHashCode (Inherited from Object.)
Public methodGetType (Inherited from Object.)
Protected methodMemberwiseClone (Inherited from Object.)
Public methodToString (Inherited from Object.)
See Also