Microsoft Powershell Active Directory

This connector leverages Microsoft PowerShell Active Directory cmdlets to manage email rules, compliance, and security features within an organization's Active Directory.

Microsoft Powershell Active Directory is a powerful tool for managing and automating tasks within Active Directory environments. This connector enables Swimlane Turbine users to streamline Active Directory management, compliance searches, and email security operations directly from the Swimlane platform. By integrating with Microsoft Powershell Active Directory, users can automate actions such as managing quarantine messages, compliance searches, transport rules, and tenant allow/block list items, enhancing the efficiency and responsiveness of security workflows.

Prerequisites

To utilize the Microsoft PowerShell Active Directory connector for Turbine, ensure you have the following prerequisites:

Custom authentication with the following parameters:

Username: The account username with permissions to execute Active Directory cmdlets.

Password: The corresponding password for the provided username.

Modern authentication with the following parameters:

Certificate: The file path to the certificate used for secure authentication.

Certificate Password: The password to access the certificate file.

App ID: The application identifier registered in Azure AD for delegated permissions.

Organization: The name of the organization or tenant in which the operations will be performed.

Capabilities

This connector provides the following capabilities:

Delete Quarantine Message

Get Compliance Search Action

Get Compliance Search

Get Hosted Content Filter Policy

Get MessageTrace

Get Quarantine Message

Get Quarantine Message Header

Get Tenant Allow Block List Items

Get Transport Rule

New Compliance Search

New Compliance Search Action

New Tenant Allow/Block List Items

New Transport Rule

Release Quarantine Message

Remove Compliance Search ... and so on

Notes

You need to be assigned permissions before you can run this cmdlet.To find the permissions required to run any cmdlet or parameter in your organization, see Find the permissions required to run any Exchange cmdlet.

The Identities parameter identifies quarantined messages for bulk operations. You identify the messages by using the syntax: value1,value2...valueN. Each value is a unique quarantined message identifier in the format GUID1\GUID2 (for example c14401cf-aa9a-465b-cfd5-08d0f0ca37c5\4c2ca98e-94ea-db3a-7eb8-3b63657d4db7).

You can find the Identity value for a quarantined message by using the Get-QuarantineMessage cmdlet. When you use this parameter, the Identity parameter is required, but the value is ignored.

For more details on the syntax and documentation, please refer to Microsoft Powershell Documentation

To set up a certificate for the app follow this link

To generate Base64 Encoded Certificate perform below steps in powershell window.

  $cert_byteArray = Get-Content -Path <path of .pfx file> -AsByteStream -Raw
  $base_64_encode_cert_string = [System.Convert]::ToBase64String($byteArray)
  $base_64_encode_cert_string

Once you have the encoded certificate pass the $base_64_encode_cert_string value in asset.

For more details on the Date syntax and documentation, please refer to Date

Configurations

Powershell Basic Auth

Authenticates to Exchange Online with Username and Password

Configuration Parameters

Parameter	Description	Type	Required
placeholder	Placeholder that will be removed	string	Optional
un	Username	string	Required
password	password	string	Required
error_status_code	The Status codes more than 300 can also be used.	boolean	Optional

Powershell Modern Authentication

Authenticates using Certificate file path, Password, App ID and Organization name.

Configuration Parameters

Parameter	Description	Type	Required
base64_encoded_cert	Base64-encoded Client Side Certificate.	string	Required
cert_password	This is the password which was given while generating the certificate.	string	Required
app_id	Application Id.	string	Required
error_status_code	The Status codes more than 300 can also be used.	boolean	Optional
org	Name of the Organization.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Delete Quarantine Message

Remove a specified quarantine message from your organization with Microsoft Powershell's Delete-QuarantineMessage cmdlet.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
identity	string	Optional	Unique identifier
identities	array	Optional	Unique identifier
whatIf	boolean	Optional	Parameter for Delete Quarantine Message
entityType	string	Optional	Type of the resource
hardDelete	boolean	Optional	Parameter for Delete Quarantine Message
RecipientAddress	array	Optional	Parameter for Delete Quarantine Message

Input Example

{"json_body":{"identity":"c14401cf-aa9a-465b-cfd5-08d0f0ca37c5","identities":["c14401cf-aa9a-465b-cfd5-08d0f0ca37c5","c14401cf-aa9a-465b-cfd5-08d0f0ca37c5"],"whatIf":false,"entityType":"Email","hardDelete":false,"RecipientAddress":["Address1","Address2"]}}

Output

Parameter	Type	Description
output	object	Output field: output
output.delete_quarantine_message	string	Response message
status_code	number	HTTP status code of the response
headers	object	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"output":{"delete_quarantine_message":"Quarantine Message 1c742508-01be-4dab-557f-08dc0cd56816\\66270fb6-5579-7394-6699-..."},"status_code":200,"headers":null,"reason":"OK"}

Get Compliance Search

Retrieve estimated compliance search results from Exchange Server 2016 or later and the Microsoft Purview compliance portal.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
Case	string	Optional	The Case parameter filters the results by the name of an eDiscovery Standard case that the compliance search is associated with. If the value contains spaces, enclose the value in quotation marks.
DomainController	string	Optional	The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN).
Identity	string	Optional	The Identity parameter specifies the compliance search that you want to view.
ResultSize	number	Optional	The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter.

Input Example

{"json_body":{"Case":"1234","DomainController":"dc01.contoso.com","Identity":"Case 1234","ResultSize":1000}}

Get Compliance Search Action

Retrieve compliance search actions from Microsoft Exchange using the Get-ComplianceSearchAction cmdlet.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
Case	string	Optional	The Case parameter filters the results by the name of an eDiscovery Standard case that the compliance search is associated with. If the value contains spaces, enclose the value in quotation marks.
DomainController	string	Optional	The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN).
Identity	string	Optional	The Identity parameter specifies the compliance search that you want to view.
Details	boolean	Optional	The Details parameter specifics if verbose details should be returned
ResultSize	number	Optional	The ResultSize parameter specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter.

Input Example

{"json_body":{"Case":"1234","DomainController":"dc01.contoso.com","Identity":"Case 1234","ResultSize":1000}}

Get Hosted Content Filter Policy

Retrieve the configuration of spam filter policies within your organization using Microsoft Powershell Active Directory.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
identity	string	Optional	The Identity parameter specifies the spam filter policy that you want to view. You can use any value that uniquely identifies the policy. For example: Name, Distinguished name (DN), GUID.

Input Example

{"json_body":{"identity":"c14401cf-aa9a-465b-cfd5-08d0f0ca37c5"}}

Get Message Trace

Trace email messages through the organization using Microsoft PowerShell's Get-MessageTrace cmdlet.

Input

Argument Name	Type	Required	Description
args	string	Optional	Parameter for Get Message Trace

Input Example

{"json_body":{"args":"-SenderAddress [email protected] -StartDate 06/13/2018 -EndDate 06/15/2018"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

Get Quarantine Message

Retrieve quarantined messages and files from SharePoint, OneDrive, and Microsoft Teams for review.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
args	string	Optional	Parameter for Get Quarantine Message

Input Example

{"json_body":{"args":"-PageSize 50 -Page 3"}}

Output

Parameter	Type	Description
output	array	Output field: output
output.Identity	string	Unique identifier
output.ReceivedTime	string	Time value
output.Organization	string	Output field: output.Organization
output.MessageId	string	Unique identifier
output.SenderAddress	string	Output field: output.SenderAddress
output.RecipientAddress	array	Output field: output.RecipientAddress
output.Subject	string	Output field: output.Subject
output.Size	number	Output field: output.Size
output.Type	string	Type of the resource
output.PolicyType	string	Type of the resource
output.PolicyName	string	Name of the resource
output.TagName	string	Name of the resource
output.PermissionToBlockSender	boolean	Output field: output.PermissionToBlockSender
output.PermissionToDelete	boolean	Output field: output.PermissionToDelete
output.PermissionToPreview	boolean	Output field: output.PermissionToPreview
output.PermissionToRelease	boolean	Output field: output.PermissionToRelease
output.PermissionToRequestRelease	boolean	Output field: output.PermissionToRequestRelease
output.PermissionToViewHeader	boolean	Output field: output.PermissionToViewHeader
output.PermissionToDownload	boolean	Output field: output.PermissionToDownload
output.Released	boolean	Output field: output.Released
output.ReleaseStatus	string	Status value
output.SystemReleased	boolean	Output field: output.SystemReleased
output.RecipientCount	number	Count value
output.QuarantineTypes	string	Type of the resource

Output Example

{"output":[{"Identity":"d0647d75-9f2e-4e1c-39fa-08dc18dfeadb\\b79418b8-9664-1762-9564-a81894155cd3","ReceivedTime":"2024-01-19T11:15:17.677721+00:00","Organization":"f5d73c4c-bb3d-421b-8bee-424916a4acca","MessageId":"<SJ0PR14MB591211115FDCC890B6CF33848C702@SJ0PR14MB5912.namprd14.prod.outlook.com>","SenderAddress":"[email protected]","RecipientAddress":[],"Subject":"WARNINGIs this a phish?","Size":130656,"Type":"Malware","PolicyType":"AntiMalwarePolicy","PolicyName":"Defaul...

Get Quarantine Message Header

Retrieve the message header of a quarantined email using the 'identity' parameter in Microsoft Powershell Active Directory.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
identity	string	Optional	Unique identifier
entityType	string	Optional	Type of the resource
RecipientAddress	array	Optional	Parameter for Get Quarantine Message Header

Input Example

{"json_body":{"identity":"c14401cf-aa9a-465b-cfd5-08d0f0ca37c5\\4c2ca98e-94ea-db3a-7eb8-3b63657d4db7","entityType":"Email","RecipientAddress":["Address1","Address2"]}}

Output

Parameter	Type	Description
output	object	Output field: output
output.Identity	string	Unique identifier
output.Organization	string	Output field: output.Organization
output.Header	string	Output field: output.Header
status_code	number	HTTP status code of the response
headers	object	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"output":{"Identity":"9a3a0d26-9776-4f99-c803-08dc1049994d\\9041764c-9101-2ca9-48b8-39dd693460c0","Organization":"f5d73c4c-bb3d-421b-8bee-424916a4acca","Header":"Authentication-Results: dkim=none (message not signed)\r\n header.d=none;dmarc=non..."},"status_code":200,"headers":null,"reason":"OK"}

Get Tenant Allow Block List Items

Retrieve entries from the Tenant Allow/Block List in Microsoft Defender by specifying the listType.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
entry	string	Optional	The Entry parameter filters the results based on the ListType parameter value. Valid values are: FileHash: The exact SHA256 file hash value. Sender: The exact domain or email address value. Url: The exact URL value. IP: IPv6 addresses only. Single IPv6 addresses in colon-hexadecimal or zero-compression format or CIDR IPv6 ranges from 1 to 128. This value is shown in the Value property of the entry in the output of the Get-TenantAllowBlockListItems cmdlet.

listType	string	Optional	The ListType parameter specifies the list to view.

allow	boolean	Optional	The Allow switch filters the results for allow entries. You don't need to specify a value with this switch.

block	boolean	Optional	The Block switch filters the results for block entries. You don't need to specify a value with this switch.

expirationDate	string	Optional	The ExpirationDate parameter filters the results by expiration date in Coordinated Universal Time (UTC). To specify a date/time value for this parameter, use either of the following options: Specify the date/time value in UTC: For example, "2021-05-06 14:30:00z". Specify the date/time value as a formula that converts the date/time in your local time zone to UTC: For example, (Get-Date "5/6/2020 9:30 AM").ToUniversalTime(). For more information, see Readme.

listSubType	array	Optional	The ListSubType parameter filters the results by subtype. Valid values are: - AdvancedDelivery - Tenant (default value)

noExpiration	boolean	Optional	The NoExpiration switch filters the results by entries that are set to never expire. You don't need to specify a value with this switch.

outputJson	boolean	Optional	The OutputJson switch specifies whether to return all entries in a single JSON value. You don't need to specify a value with this switch. Use this switch to prevent the command from halting on the first entry that contains a syntax error.

Input Example

{"json_body":{"entry":["768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3"],"listType":"Url","allow":false,"block":false,"expirationDate":"2021-05-06 14:30:00z","listSubType":"AdvancedDelivery","noExpiration":false,"outputJson":false}}

Get Transport Rule

Retrieve a list of email transport rules from your organization's system using Microsoft Powershell Active Directory.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
args	string	Optional	A string including valid keyworkd arguments for this command. For a list of valid arguments, please see https://learn.microsoft.com/en-us/powershell/module/exchange/get-transportrule?view=exchange-ps#syntax

Input Example

{"args":"string"}

Output

Parameter	Type	Description
output	object	Output field: output
output.Priority	number	Output field: output.Priority
output.DlpPolicy	object	Output field: output.DlpPolicy
output.DlpPolicyId	string	Unique identifier
output.Comments	string	Output field: output.Comments
output.CreatedBy	string	Output field: output.CreatedBy
output.LastModifiedBy	string	Output field: output.LastModifiedBy
output.ManuallyModified	boolean	Output field: output.ManuallyModified
output.ActivationDate	object	Date value
output.ExpiryDate	object	Date value
output.Description	string	Output field: output.Description
output.RuleVersion	object	Output field: output.RuleVersion
output.RuleVersion.Major	number	Output field: output.RuleVersion.Major
output.RuleVersion.Minor	number	Output field: output.RuleVersion.Minor
output.RuleVersion.Build	number	Output field: output.RuleVersion.Build
output.RuleVersion.Revision	number	Output field: output.RuleVersion.Revision
output.RuleVersion.MajorRevision	number	Output field: output.RuleVersion.MajorRevision
output.RuleVersion.MinorRevision	number	Output field: output.RuleVersion.MinorRevision
output.Size	number	Output field: output.Size
output.Conditions	object	Output field: output.Conditions
output.Exceptions	object	Output field: output.Exceptions
output.Actions	array	Output field: output.Actions
output.State	string	Output field: output.State
output.Mode	string	Output field: output.Mode
output.RuleErrorAction	string	Error message if any

Output Example

{"output":{"Priority":0,"DlpPolicy":null,"DlpPolicyId":"00000000-0000-0000-0000-000000000000","Comments":"\n","CreatedBy":"Travis Riley","LastModifiedBy":"Travis Riley","ManuallyModified":false,"ActivationDate":null,"ExpiryDate":null,"Description":"Take the following actions:\r\n\tset message header 'X-VMRay-Auth' with the value '...","RuleVersion":{"Major":14,"Minor":0,"Build":0,"Revision":0,"MajorRevision":0,"MinorRevision":0},"Size":397,"Conditions":null,"Exceptions":null,"Actions":["Microsof...

New Compliance Search

Initiates a new compliance search in Exchange Server 2016 or later and Microsoft Purview using the New-ComplianceSearch cmdlet.

Input

Argument Name	Type	Required	Description
name	string	Optional	Name of the resource
exchangeLocation	string	Optional	Parameter for New Compliance Search
allowNotFoundExchangeLocationsEnabled	number	Optional	Parameter for New Compliance Search
contentMatchQuery	string	Optional	Response content
confirm	boolean	Optional	Parameter for New Compliance Search
exchangeLocationExclusion	string	Optional	Parameter for New Compliance Search
description	string	Optional	Parameter for New Compliance Search
holdNames	string	Optional	Name of the resource
includeOrgContent	number	Optional	Response content
includeUserAppContent	number	Optional	Response content
language	string	Optional	Parameter for New Compliance Search
logLevel	string	Optional	Parameter for New Compliance Search
publicFolderLocation	string	Optional	Parameter for New Compliance Search
refinerNames	string	Optional	Name of the resource
sharePointLocation	string	Optional	Parameter for New Compliance Search
sharePointLocationExclusion	string	Optional	Parameter for New Compliance Search
statusMailRecipients	string	Optional	Status value
whatIf	boolean	Optional	Parameter for New Compliance Search

Input Example

{"json_body":{"name":"Hold Project X","exchangeLocation":"Finance Department","allowNotFoundExchangeLocationsEnabled":true,"contentMatchQuery":"'Patent' AND 'Project Tailspin Toys'","confirm":false,"exchangeLocationExclusion":"","description":"","holdNames":"","includeOrgContent":"","includeUserAppContent":true,"language":"Japanese","logLevel":"","publicFolderLocation":"","refinerNames":"","sharePointLocation":"","sharePointLocationExclusion":"","statusMailRecipients":"","whatIf":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

New Compliance Search Action

Initiates a new content search in Exchange Server and Microsoft Purview compliance portal using the New-ComplianceSearchAction cmdlet.

Input

Argument Name	Type	Required	Description
searchName	string	Optional	Name of the resource
purge	boolean	Optional	Parameter for New Compliance Search Action
purgeType	string	Optional	Type of the resource
actionName	string	Optional	Name of the resource
archiveFormat	string	Optional	Parameter for New Compliance Search Action
enableDedupe	string	Optional	Parameter for New Compliance Search Action
exchangeArchiveFormat	string	Optional	Parameter for New Compliance Search Action
export	boolean	Optional	Parameter for New Compliance Search Action
fileTypeExclusionsForUnindexedItems	string	Optional	Type of the resource
force	boolean	Optional	Parameter for New Compliance Search Action
format	string	Optional	Parameter for New Compliance Search Action
includeCredential	boolean	Optional	Parameter for New Compliance Search Action
includeSharePointDocumentVersions	boolean	Optional	Parameter for New Compliance Search Action
jobOptions	string	Optional	Parameter for New Compliance Search Action
notifyEmail	string	Optional	Parameter for New Compliance Search Action
notifyEmailCC	string	Optional	Parameter for New Compliance Search Action
preview	boolean	Optional	Parameter for New Compliance Search Action
referenceActionName	string	Optional	Name of the resource
region	string	Optional	Parameter for New Compliance Search Action
report	boolean	Optional	Parameter for New Compliance Search Action
retentionReport	boolean	Optional	Parameter for New Compliance Search Action
retryOnError	boolean	Optional	Error message if any
scenario	string	Optional	Parameter for New Compliance Search Action
scope	string	Optional	Parameter for New Compliance Search Action
searchNames	string	Optional	Name of the resource

Input Example

{"json_body":{"searchName":"Remove Phishing Message","purge":"","purgeType":"SoftDelete","actionName":"","archiveFormat":"","enableDedupe":"","exchangeArchiveFormat":"PerUserPst","export":"","fileTypeExclusionsForUnindexedItems":"","force":"","format":"FxStream","includeCredential":"","includeSharePointDocumentVersions":true,"jobOptions":"","notifyEmail":"","notifyEmailCC":"","preview":"","referenceActionName":"","region":"","report":"","retentionReport":"","retryOnError":"","scenario":"AnalyzeWithZoom","scope":"IndexedItemsOnly","searchNames":"","sharePointArchiveFormat":"SingleZip","shareRootPath":"","version":"","whatIf":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

New Tenant Allow/Block List Items

Create new entries in the tenant's allow/block list with Microsoft Powershell, specifying list types and expiration options.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
entries	array	Optional	The Entries parameter specifies the values that you want to add to the Tenant Allow/Block List based on the ListType parameter value.
listType	string	Optional	The ListType parameter specifies the type of entry to add.
allow	boolean	Optional	The Allow switch specifies that you're creating an allow entry.
block	boolean	Optional	The Allow switch specifies that you're creating a block entry.
expirationDate	string	Optional	The ExpirationDate parameter set the expiration date of the entry in Coordinated Universal Time (UTC).
listSubType	string	Optional	The ListSubType parameter specifies the subtype for this entry.
noExpiration	boolean	Optional	The NoExpiration switch specifies that the entry should never expire. You don't need to specify a value with this switch.
logExtraDetails	boolean	Optional	The Log Extra Details parameter.
notes	string	Optional	The Notes parameters specifies additional information about the object.
removeAfter	number	Optional	The RemoveAfter parameter enables the Remove on > 45 days after last used date feature for an allow entry.
submissionID	string	Optional	This parameter is reserved for internal Microsoft use.

Input Example

{"json_body":{"entries":["768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3"],"listType":"Url","allow":false,"block":false,"expirationDate":"2021-05-06 14:30:00z","listSubType":"AdvancedDelivery","noExpiration":false,"logExtraDetails":false,"notes":"This is a note about the item","removeAfter":45,"submissionID":""}}

New Transport Rule

Creates a new transport rule in Microsoft Powershell Active Directory to manage mail flow using the provided name.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
name	string	Optional	Display name for the rule being created
betweenMemberOf1	string	Optional	The BetweenMemberOf1 parameter specifies a condition that looks for messages that are sent between group members. You need to use this parameter with the BetweenMemberOf2 parameter.
betweenMemberOf2	string	Optional	The BetweenMemberOf2 parameter specifies a condition that looks for messages that are sent between group members. You need to use this parameter with the BetweenMemberOf1 parameter.
deleteMessage	boolean	Optional	Action to delete the message matching this rule
redirectMessageTo	string	Optional	The RedirectMessageTo parameter specifies a rule action that redirects messages to the specified recipients
stopRuleProcessing	boolean	Optional	The StopRuleProcessing parameter specifies an action that stops processing more rules
prependSubject	string	Optional	The PrependSubject parameter specifies an action that adds text to add to the beginning of the Subject field of messages
rejectMessageReasonText	string	Optional	The RejectMessageReasonText parameter specifies the explanation text that's used when the rule rejects messages.

Input Example

{"name":"Example Name","betweenMemberOf1":"string","betweenMemberOf2":"string","deleteMessage":true,"redirectMessageTo":"string","stopRuleProcessing":true,"prependSubject":"string","rejectMessageReasonText":"string"}

Output

Parameter	Type	Description
output	object	Output field: output
output.Priority	number	Output field: output.Priority
output.DlpPolicy	object	Output field: output.DlpPolicy
output.DlpPolicyId	string	Unique identifier
output.Comments	object	Output field: output.Comments
output.CreatedBy	string	Output field: output.CreatedBy
output.LastModifiedBy	string	Output field: output.LastModifiedBy
output.ManuallyModified	boolean	Output field: output.ManuallyModified
output.ActivationDate	object	Date value
output.ExpiryDate	object	Date value
output.Description	string	Output field: output.Description
output.RuleVersion	object	Output field: output.RuleVersion
output.RuleVersion.Major	number	Output field: output.RuleVersion.Major
output.RuleVersion.Minor	number	Output field: output.RuleVersion.Minor
output.RuleVersion.Build	number	Output field: output.RuleVersion.Build
output.RuleVersion.Revision	number	Output field: output.RuleVersion.Revision
output.RuleVersion.MajorRevision	number	Output field: output.RuleVersion.MajorRevision
output.RuleVersion.MinorRevision	number	Output field: output.RuleVersion.MinorRevision
output.Size	number	Output field: output.Size
output.Conditions	array	Output field: output.Conditions
output.Exceptions	object	Output field: output.Exceptions
output.Actions	array	Output field: output.Actions
output.State	string	Output field: output.State
output.Mode	string	Output field: output.Mode
output.RuleErrorAction	string	Error message if any

Output Example

{"output":{"Priority":13,"DlpPolicy":null,"DlpPolicyId":"00000000-0000-0000-0000-000000000000","Comments":null,"CreatedBy":"integrations","LastModifiedBy":"integrations","ManuallyModified":false,"ActivationDate":null,"ExpiryDate":null,"Description":"If the message:\r\n\tBetween members of the groups '[email protected]' and 'mar...","RuleVersion":{"Major":14,"Minor":0,"Build":0,"Revision":0,"MajorRevision":0,"MinorRevision":0},"Size":522,"Conditions":["Microsoft.Exchange.MessagingPolicies.Rul...

Release Quarantine Message

Facilitates the release of specified messages from quarantine to recipients in a cloud-based organization via Microsoft's Release-QuarantineMessage cmdlet.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
user	array	Optional	Parameter for Release Quarantine Message
identity	string	Optional	Unique identifier
allowSender	boolean	Optional	Parameter for Release Quarantine Message
force	boolean	Optional	Parameter for Release Quarantine Message
releaseToAll	boolean	Optional	Parameter for Release Quarantine Message
reportFalsePositive	boolean	Optional	Parameter for Release Quarantine Message
whatIf	boolean	Optional	Parameter for Release Quarantine Message

Input Example

{"json_body":{"user":["[email protected]","[email protected]"],"identity":"c14401cf-aa9a-465b-cfd5-08d0f0ca37c5\\4c2ca98e-94ea-db3a-7eb8-3b63657d4db7","allowSender":false,"force":false,"releaseToAll":false,"reportFalsePositive":false,"whatIf":false}}

Output

Parameter	Type	Description
output	object	Output field: output
status_code	number	HTTP status code of the response
headers	object	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"output":{},"status_code":200,"headers":null,"reason":"OK"}

Remove Compliance Search

Removes existing compliance searches from Exchange Server 2016 and the Microsoft Purview compliance portal.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
Confirm	boolean	Optional	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.
Identity	string	Optional	The Identity parameter specifies the compliance search that you want to remove.
WhatIf	boolean	Optional	The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes.

Input Example

{"json_body":{"Confirm":false,"Identity":"Case 1234","WhatIf":false}}

Remove Tenant Allow Block List Items

Removes specified entries from the Microsoft Defender Tenant Allow/Block List using provided list types.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
ids	array	Optional	The IDs parameter specifies the entries that you want to remove. This value is shown in the Identity property in the output of the Get-TenantAllowBlockListItems cmdlet. An example value for this parameter is RgAAAAAI8gSyI_NmQqzeh-HXJBywBwCqfQNJY8hBTbdlKFkv6BcUAAAl_QCZAACqfQNJY8hBTbdlKFkv6BcUAAAl_oSPAAAA0. You can't use this parameter with the Entries parameter.
entries	array	Optional	The Entries parameter specifies the entries that you want to remove based on the ListType parameter value. Valid values are: FileHash: The exact SHA256 file hash value. Sender domains and email addresses: The exact domain or email address value. Url: The exact URL value. IP: IPv6 addresses only. Single IPv6 addresses in colon-hexadecimal or zero-compression format or CIDR IPv6 ranges from 1 to 128. This value is shown in the Value property of the entry in the output of the Get-TenantAllowBlockListItems cmdlet. You can't mix value types (sender, URL, file, or IP address) or allow and block actions in the same command. You can't use this parameter with the IDs parameter.
listType	string	Optional	The ListType parameter specifies the type of entry that you want to remove. Valid values are: FileHash, Sender, Url, IP.
listSubType	string	Optional	The ListSubType specifies further specifies the type of entry that you want to remove. Valid values are: AdvancedDelivery: Use this value for phishing simulation URLs. Tenant: This is the default value.
outputJson	boolean	Optional	The OutputJson switch specifies whether to return all entries in a single JSON value. You don't need to specify a value with this switch. You use this switch to prevent the command from halting on the first entry that contains a syntax error.

Input Example

{"json_body":{"ids":["RgAAAAAI8gSyI_NmQqzeh-HXJBywBwCqfQNJY8hBTbdlKFkv6BcUAAAl_QCZAACqfQNJY8hBTbdlKFkv6BcUAAAl_oSPAAAA0"],"entries":["768a813668695ef2483b2bde7cf5d1b2db0423a0d3e63e498f3ab6f2eb13ea3"],"listType":"Url","listSubType":"AdvancedDelivery","outputJson":false}}

Remove Transport Rule

Eliminate a specific transport rule in Microsoft Powershell Active Directory using the 'identity' parameter.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
identity	string	Optional	The Identity parameter specifies the rule that you want to remove. You can use any value that uniquely identifies the rule
whatIf	boolean	Optional	The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes

Input Example

{"identity":"string","whatIf":true}

Output

Parameter	Type	Description
output	object	Output field: output
output.remove_transport_rule	string	Output field: output.remove_transport_rule
status_code	number	HTTP status code of the response
headers	array	HTTP headers for the request
headers.file_name	string	HTTP headers for the request
headers.file	string	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"output":{"remove_transport_rule":"Rule hernan rule from manifest 1 removed"},"status_code":200,"headers":[],"reason":"OK"}

Set Hosted Connection Filter Policy

Modifies connection filter policies in a cloud-based organization using Microsoft Powershell Active Directory cmdlets.

Input

Argument Name	Type	Required	Description
identity	string	Optional	Unique identifier
adminDisplayName	string	Optional	Name of the resource
configurationXmlRaw	string	Optional	Parameter for Set Hosted Connection Filter Policy
enableSafeList	boolean	Optional	Parameter for Set Hosted Connection Filter Policy
iPAllowList	string	Optional	Parameter for Set Hosted Connection Filter Policy
iPBlockList	string	Optional	Parameter for Set Hosted Connection Filter Policy
makeDefault	string	Optional	Parameter for Set Hosted Connection Filter Policy
whatIf	boolean	Optional	Parameter for Set Hosted Connection Filter Policy

Input Example

{"json_body":{"identity":"Name","adminDisplayName":"Policy for High-Security Users","configurationXmlRaw":"","enableSafeList":true,"iPAllowList":"192.168.1.10,192.168.1.23","iPBlockList":"10.10.10.0/25,172.17.17.0/24","makeDefault":"","whatIf":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

Set Hosted Content Filter Policy

Modify spam filter policies in your cloud-based organization using the Set-HostedContentFilterPolicy cmdlet.

Input

Argument Name	Type	Required	Description
addXHeaderValue	string	Optional	Value for the parameter
adminDisplayName	string	Optional	Name of the resource
allowedSenderDomains	string	Optional	Parameter for Set Hosted Content Filter Policy
allowedSenders	string	Optional	Parameter for Set Hosted Content Filter Policy
blockedSenderDomains	string	Optional	Parameter for Set Hosted Content Filter Policy
blockedSenders	string	Optional	Parameter for Set Hosted Content Filter Policy
bulkQuarantineTag	string	Optional	Parameter for Set Hosted Content Filter Policy
bulkSpamAction	string	Optional	Parameter for Set Hosted Content Filter Policy
bulkThreshold	number	Optional	Parameter for Set Hosted Content Filter Policy
downloadLink	boolean	Optional	Parameter for Set Hosted Content Filter Policy
enableEndUserSpamNotifications	boolean	Optional	Parameter for Set Hosted Content Filter Policy
enableLanguageBlockList	boolean	Optional	Parameter for Set Hosted Content Filter Policy
enableRegionBlockList	boolean	Optional	Parameter for Set Hosted Content Filter Policy
endUserSpamNotificationCustomFromAddress	string	Optional	Parameter for Set Hosted Content Filter Policy
endUserSpamNotificationCustomFromName	string	Optional	Name of the resource
endUserSpamNotificationCustomSubject	string	Optional	Parameter for Set Hosted Content Filter Policy
endUserSpamNotificationFrequency	number	Optional	Parameter for Set Hosted Content Filter Policy
endUserSpamNotificationLanguage	string	Optional	Parameter for Set Hosted Content Filter Policy
endUserSpamNotificationLimit	number	Optional	Parameter for Set Hosted Content Filter Policy
highConfidencePhishAction	string	Optional	Unique identifier
highConfidencePhishQuarantineTag	string	Optional	Unique identifier
highConfidenceSpamAction	string	Optional	Unique identifier
highConfidenceSpamQuarantineTag	string	Optional	Unique identifier
identity	string	Optional	Unique identifier
increaseScoreWithBizOrInfoUrls	string	Optional	URL endpoint for the request

Input Example

{"json_body":{"addXHeaderValue":"BulkSpamAction","adminDisplayName":"Policy for High-Security Users","allowedSenderDomains":"example.com","allowedSenders":"example.com","blockedSenderDomains":"spamdomain.com","blockedSenders":"[email protected]","bulkQuarantineTag":"Name","bulkSpamAction":"AddXHeader","bulkThreshold":6,"downloadLink":false,"enableEndUserSpamNotifications":false,"enableLanguageBlockList":true,"enableRegionBlockList":true,"endUserSpamNotificationCustomFromAddress":"[email protected]","endUserSpamNotificationCustomFromName":"","endUserSpamNotificationCustomSubject":"","endUserSpamNotificationFrequency":0,"endUserSpamNotificationLanguage":"en","endUserSpamNotificationLimit":0,"highConfidencePhishAction":"Redirect","highConfidencePhishQuarantineTag":"Name","highConfidenceSpamAction":"AddXHeader","highConfidenceSpamQuarantineTag":"Name","identity":"Name","increaseScoreWithBizOrInfoUrls":"Off","increaseScoreWithImageLinks":"Off","increaseScoreWithNumericIps":"Off","increaseScoreWithRedirectToOtherPort":"Off","inlineSafetyTipsEnabled":true,"intraOrgFilterState":"Default","languageBlockList":"ISO 639-1","makeDefault":"","markAsSpamBulkMail":"Off","markAsSpamEmbedTagsInHtml":"Off","markAsSpamEmptyMessages":"Off","markAsSpamFormTagsInHtml":"Off","markAsSpamFramesInHtml":"Off","markAsSpamFromAddressAuthFail":"Off","markAsSpamJavaScriptInHtml":"Off","markAsSpamNdrBackscatter":"Off","markAsSpamObjectTagsInHtml":"Off","markAsSpamSensitiveWordList":"Off","markAsSpamSpfRecordHardFail":"Off","markAsSpamWebBugsInHtml":"Off","modifySubjectValue":"BulkSpamAction","phishQuarantineTag":"Name","phishSpamAction":"AddXHeader","phishZapEnabled":true,"quarantineRetentionPeriod":"BulkSpamAction","redirectToRecipients":"BulkSpamAction","regionBlockList":"ISO 3166-1","spamAction":"AddXHeader","spamQuarantineTag":"Name","spamZapEnabled":true,"testModeAction":"AddXHeader","testModeBccToRecipients":"","whatIf":false}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}

Set Tenant Allow/Block List Items

Updates the Microsoft Powershell Active Directory Tenant Allow/Block List with specified JSON entries.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
ids	array	Optional	Specifies the entries that you want to modify
entries	array	Optional	The Entries parameter specifies the entries that you want to modify based on the ListType parameter value
listType	string	Optional	specifies the type of entry that you want to modify. Valid values are "FileHash", "Sender", "Url"
allow	boolean	Optional	The Allow switch specifies that you're modifying an allow entry. You don't need to specify a value with this switch
block	boolean	Optional	The Block switch specifies that you're modifying a block entry. You don't need to specify a value with this switch
expirationDate	string	Optional	The ExpirationDate parameter filters the results by expiration date in Coordinated Universal Time (UTC)
listSubType	string	Optional	The ListSubType parameter further specifies the entry that you want to modify. Valid values are "AdvancedDelivery", "Tenant"
noExpiration	boolean	Optional	The NoExpiration switch specifies that the entry should never expire. You don't need to specify a value with this switch
notes	string	Optional	The Notes parameters specifies additional information about the object

Input Example

{"ids":["string"],"entries":["string"],"listType":"string","allow":true,"block":true,"expirationDate":"string","listSubType":"string","noExpiration":true,"notes":"string"}

Set Transport Rule

Modifies an existing transport rule in Microsoft Powershell Active Directory using a specified identity.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
identity	string	Optional	Specifies the rule that you want to modify. You can use any value that uniquely identifies the rule
name	string	Optional	Display name for the rule being created
betweenMemberOf1	string	Optional	The BetweenMemberOf1 parameter specifies a condition that looks for messages that are sent between group members. You need to use this parameter with the BetweenMemberOf2 parameter.
betweenMemberOf2	string	Optional	The BetweenMemberOf2 parameter specifies a condition that looks for messages that are sent between group members. You need to use this parameter with the BetweenMemberOf1 parameter.
deleteMessage	boolean	Optional	Action to delete the message matching this rule
redirectMessageTo	string	Optional	The RedirectMessageTo parameter specifies a rule action that redirects messages to the specified recipients
stopRuleProcessing	boolean	Optional	The StopRuleProcessing parameter specifies an action that stops processing more rules
prependSubject	string	Optional	The PrependSubject parameter specifies an action that adds text to add to the beginning of the Subject field of messages
rejectMessageReasonText	string	Optional	The RejectMessageReasonText parameter specifies the explanation text that's used when the rule rejects messages.

Input Example

{"identity":"string","name":"Example Name","betweenMemberOf1":"string","betweenMemberOf2":"string","deleteMessage":true,"redirectMessageTo":"string","stopRuleProcessing":true,"prependSubject":"string","rejectMessageReasonText":"string"}

Start ADSyncSync Cycle

Initiates an Active Directory synchronization cycle with custom arguments using Microsoft Powershell Active Directory.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
args	string	Optional	Parameter for Start ADSyncSync Cycle

Input Example

{"json_body":{"args":" -PolicyType Delta"}}

Start Compliance Search

Initiates a compliance search in Microsoft Powershell Active Directory using predefined criteria.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
Confirm	boolean	Optional	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.
Force	boolean	Optional	The Force switch hides warning or confirmation messages.
Identity	string	Optional	The Identity parameter specifies the compliance search that you want to start.
RetryOnError	string	Optional	The RetryOnError switch specifies whether to retry the search on any items that failed without re-running the entire search all over again.
WhatIf	boolean	Optional	The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes.

Input Example

{"json_body":{"Confirm":false,"Force":false,"Identity":"Case 1234","RetryOnError":"","WhatIf":false}}

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 2 May 2024 20:37:23 GMT