Defender for Office 365 Analyzed Emails, Now in Chat

June 30, 2026 · InfraScout Team

Two questions dominate any email-security review, and until now both meant leaving the conversation for the Defender portal. The first is a false-positive complaint — "why did this newsletter get quarantined?" The second is a threat hunt — "show me everything this sender delivered last week, and where it landed." Both answers live in Defender for Office 365's Analyzed emails feed, the same data that powers Threat Explorer. With this update, InfraScout reads that feed directly during an assessment through two new read-only tools, so you can triage and investigate email threats in the same conversation where you run the rest of the review.

Scanning a time window without drowning

The list tool, mscloud_security_list_analyzed_emails, answers the broad question first: what did Defender analyze over a given window? You give it a required start and end time, and it returns one row per analyzed message across that range. When you already have a lead, you can narrow the query to a single network message ID or to a specific recipient address, and large windows page cleanly to completion so a busy tenant reads as a sequence of pages rather than one unbounded dump.

The rows stay deliberately compact. A single analyzed message can carry a long tail of detail — every attachment, every URL, and a full timeline of detection events — and returning all of it for every row would bury the signal and blow past what an AI client can read inline. So the list keeps each row scannable: the heavy detail is summarized as counts, while the two facts you actually triage on are kept in full. You still see which mail-flow (transport) rules the message hit, and the latest delivery verdict together with where the message ultimately landed. That is enough for an AI to sweep a wide window, spot the messages worth a closer look, and pull only those.

The full record for one message

Once a row stands out, the get tool, mscloud_security_get_analyzed_email, returns everything Defender recorded about that one message — every attachment, every URL, and the complete detection detail behind the verdict. You identify the message by its network message ID within a time window, and because a single message sent to several recipients has a separate analyzed copy per mailbox, you can add a recipient address to pick out exactly the copy you mean.

This is the natural second step after a list sweep. The list tells you which message and gives you its network message ID; the get tool tells you why it was judged the way it was, in enough depth to close a false-positive ticket or to characterize a phishing campaign.

Three investigations it answers

The feed is built for the questions email-security teams ask most, and these two tools put each one a sentence away:

• False-positive triage — a user swears a legitimate message was wrongly quarantined; pull the analyzed record and read the exact detection detail behind the verdict instead of guessing.
• Phishing investigation — a bad sender is confirmed; sweep the window for everything they delivered, then open each message to see the attachments and URLs it carried.
• Delivery forensics — a message is suspicious and you need to know where it actually ended up; the latest delivery verdict and location tell you whether it reached the inbox, was quarantined, or landed in junk.

These pair naturally with the tools you already use for the same investigations. The Exchange Online message trace follows a message through mail-flow and confirms delivery, while the Microsoft 365 Unified Audit Log shows what happened around the message — who accessed the mailbox, what rules were created. Analyzed emails add the verdict and the reasoning that sits between the two.

Read-only by design

Both tools only read. There is intentionally no remediation action here — no releasing a message from quarantine, no moving or purging mail. Defender's own remediation controls are the right place to act on a message once you have decided to, and keeping these tools read-only means an assessment can investigate email threats freely without any risk of changing mailbox state along the way.

What an administrator grants once

Analyzed emails come from Defender for Office 365 Plan 2, which is included in Microsoft 365 E5. On a tenant with that licensing, an administrator grants the Entra app registration behind the Microsoft cloud connection one new application permission — SecurityAnalyzedMessage.Read.All — and both tools become available to every assessment using that connection.

For newly onboarded tenants there is nothing extra to do: the onboarding script now grants this permission automatically as part of its standard set. Tenants that were onboarded earlier need to pick it up once — re-run the onboarding script, which is idempotent and safe to run again, or consent the single permission by hand. Until the permission is in place, the tools do not fail silently: they return a clear error that names the missing permission, so the fix is obvious from the message itself.

Try it

Open an email-security assessment and start with whichever question is in front of you. For a false positive, ask for the analyzed record of the quarantined message and read the detection detail. For a hunt, sweep the last week for a suspect sender, then open the messages that stand out. Either way, InfraScout stays in the conversation with the message trace and audit-log tools you are already running — see the full set on the Microsoft security tools page.

Questions or feedback? Reach us at info@infrascout.cloud.