How to Retrieve Actual Email Addresses from Purview Audit Data?

0
1
Asked By CuriousCoder123 On

I'm currently trying to work with some data from a Purview audit search. I'm using a PowerShell script to format the output, and it gives me a user identifier that looks like this: i:0h.f|membership|[email protected], where 'X' is a mix of characters. I'm wondering if there's a way to efficiently retrieve the actual email address of the user who shared the file. Is this something that's possible in PowerShell, or am I stepping into tricky privacy territory with M365 personal accounts? I know I could possibly access it through the SharePoint Admin by checking the user's OneDrive, but I want to avoid that to respect their privacy.

2 Answers

Answered By TechWhiz42 On

It seems you're dealing with a PUID/NetID, which is more of an internal identifier. To get the actual email address, you have a couple of options. You can either index all SharePoint profiles and pull their UserId using the SharePoint REST API, or you can try querying Exchange with a command like `Get-User -Filter "NetID -eq '100300009CBBxxx'"`.

Answered By DataDude89 On

Just a heads-up, if that external email isn't set up as a guest user in your system, the command might not work as expected. So, make sure that the user is actually registered in your environment.

Related Questions

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.