table

MessageEvents

MessageEvents contains details about Microsoft Teams messages sent and received within the organization at delivery time.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi MessageUrlInfo
Related tabletable MessagePostDeliveryEvents
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the message event was recorded.
`LastEditedTime`	string	Date and time when the message was last edited.
`TeamsMessageId`	string	Unique identifier for the message, generated by Microsoft 365.
`SenderEmailAddress`	string	Email address of the sender.
`SenderDisplayName`	string	Display name shown for the sender.
`SenderObjectId`	string	Unique identifier for the sender account.
`SenderType`	string	Type of user that sent the message.
`RecipientDetails`	dynamic	Array of recipient data.
`IsOwnedThread`	boolean	Indicates whether the message is owned by the organization.
`MessageId`	string	Non-unique identifier for the message.
`ParentMessageId`	string	Identifier for the parent message or the current message.
`GroupId`	string	Identifier for the team or group the message was sent to.
`GroupName`	string	Name of the team or group the message was sent to.
`ThreadId`	string	Identifier of the channel or chat thread.
`ThreadSubtype`	string	Channel type for the message thread.
`IsExternalThread`	boolean	Indicates whether the thread has external recipients.
`MessageFormatType`	string	Type of message format.
`MessageFormatSubtype`	string	Subtype of message format.
`MessageVersion`	string	Version number of the message.
`MessageSubject`	string	Subject of the message, if available.
`ThreatTypes`	string	Verdict from the filtering stack.
`DetectionMethods`	dynamic	Methods used to detect threats found in the message.
`ConfidenceLevel`	dynamic	List of confidence levels for each identified threat type.
`DeliveryAction`	string	Delivery action of the message.
`DeliveryLocation`	string	Location of the message at delivery time.
`ReportId`	string	Unique identifier for the event.
`SafetyTip`	string	Safety tip added to the message, if any.