We have a team that occasionally sees an email that made it in to users that contains some brand new or uncaught phishing or malware. Currently, they use message tracking to find the copies that came in, they export that result to a csv, then send it to our O365 team to hopefully delete the messages from users mailboxes. The issue is the Microsoft cmdlet they use to delete the email takes as input the From header value in the email and not the envelope sender (or as Microsoft calls it the return-path). Many times that is ok as they match, but often with phishing and bad actor stuff, they purposely do not match. Microsoft added as a feature request to add the return-path as input to the cmdlet but that will take time. My question is, can I some way add the from field to the exported data in a message trace? Other ideas how we can give our Risk Management team the ability to search for email and extract the from header along with the to, subject, etc? Thanks.
