table

EmailPostDeliveryEvents

EmailPostDeliveryEvents contains post-delivery actions taken on email messages after Microsoft 365 delivers them to recipient mailboxes.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi EmailEvents
Related tabletable EmailAttachmentInfo
Related tabletable EmailUrlInfo
Related tabletable

Schema

Field	Type	Description	Copy
`Timestamp`	datetime	Date and time when the event was recorded.
`NetworkMessageId`	string	Unique identifier for the email, generated by Microsoft 365.
`InternetMessageId`	string	Public-facing identifier set by the sending email system.
`Action`	string	Action taken on the entity.
`ActionType`	string	Type of activity that triggered the event, such as manual remediation or ZAP.
`ActionTrigger`	string	Indicates whether the action was triggered by an administrator or automated mechanism.
`ActionResult`	string	Result of the action.
`RecipientEmailAddress`	string	Email address of the recipient.
`DeliveryLocation`	string	Location where the email was delivered.
`ThreatTypes`	string	Verdict from the email filtering stack.
`DetectionMethods`	string	Methods used to detect malware, phishing, or other threats.
`ReportId`	string	Event identifier based on a repeating counter.
`SenderFromAddress`	string	Sender email address in the visible From header.
`EmailDirection`	string	Direction of the email relative to the organization.
`SourceLocation`	string	Location where the email triggered zero-hour auto purge.