table

MessagePostDeliveryEvents

MessagePostDeliveryEvents contains security events that occur after Microsoft Teams message delivery.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi MessageEvents
Related tabletable MessageUrlInfo
Related tabletable

Schema

Field	Type	Description	Copy
`Timestamp`	datetime	Date and time when the event was recorded.
`TeamsMessageId`	string	Unique identifier for the Teams message.
`Action`	string	Action taken on the message.
`ActionType`	string	Type of activity that triggered the event.
`ActionTrigger`	string	Indicates whether the action was administrator-triggered or automated.
`ActionResult`	string	Result of the action.
`SenderEmailAddress`	string	Email address of the sender.
`RecipientDetails`	dynamic	Array of recipient details.
`ThreatTypes`	string	Verdict from the filtering stack.
`ConfidenceLevel`	dynamic	List of confidence levels for each identified threat type.
`DetectionMethods`	string	Methods used to detect threats in the message.
`LatestDeliveryLocation`	string	Last known location of the message.
`ReportId`	string	Unique identifier for the event.
`IsExternalThread`	boolean	Indicates whether the thread has external recipients.
`SafetyTip`	string	Safety tip added to the message, if any.