Search Office 365 Creation Dates

I was recently asked to pull a list of every email account. Then we needed to search Office 365 creation dates. Of course, this also needed to be done before the end of the day. Today So we’ll start with a small function to connect to Office365-PowerShell with a new PS Session and name that session for easy closing once completed.

Search Office 365 Creation Dates

To start we first create a function called Connect-PSEX with the first line.

Function Connect-PSEX {

We then add https://ps.outlook.com/powershell to the $URL variable.

$URL = "https://ps.outlook.com/powershell"

Using the Get-Credential command to capture your login information onto O365.

$Credentials = Get-Credential -Message "Enter your Office 365 admin credentials"

In this next line, we add the New-PSSession. Then configure for O365 Microsoft Exchange use our previous $URL variable. We also need our previously grabbed credentials that reside within the $Credentials variable. This is needed to allow redirection for the site login to instantiate a pop-up window. Then we name the PSSession an easy name to remember so we can close the session easily when we are completed with our task.

$EXOSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $URL -Credential $Credentials -Authentication Basic -AllowRedirection -Name "Exchange Online"

Lastly, within this function, we have it do actual work using Import-PSSession and the variable $EXOSession

Import-PSSession $EXOSession

With the rest completed, we need to build a function to close the PSSession. When we are done instead of letting it just hang there we will close it. I used the Remove-PSSession command and called the name we specified earlier.

Function Disconnect-PSEX {
    Remove-PSSession -Name "Exchange Online"
}

The next line we call the Connect-PSEX function, login, and the function connects to O365.

Connect-PSEX

Here is where all of the fun begins. I am lazy, I do not want to do anything manually that I do not have to. So I used Get-ADUser to pull all AD accounts and output to a text file.

get-ADUser | out-string | add-content "c:\scripts\adusers.txt"

This next line we start building out the rest of my ultimate laziness. I add the location c:\scripts\adusers.txt to the variable $input_path

$input_path = "c:\scripts\adusers.txt"

This next line we add c:\scripts\extracted_addresses.txt to the variable $output_file

$output_file = "c:\scripts\extracted_addresses.txt"

We use regex wizardry to outline how email addresses should be formatted. Then store that data in the $regex variable for later use.

$regex = '\b[A-Za-z0-9._%%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}\b'

Next, we use Select-String with our $input_path variable, use our $regex variable for the patter we are looking for in Select-String, and output just the pattern to $output_file which is extracted_addresses.txt at c:\scripts\

select-string -Path $input_path -Pattern $regex -AllMatches | %% { $_.Matches } | %% { $_.Value } > $output_file

Here, we use Get-Content and load the c:\scripts\extracted_addresses.txt to the previously used $output_file variable.

$output_file = (get-Content "c:\scripts\extracted_addresses.txt")

Next

we start our ForEach, and say for every email address in the variable $output_file do the following.

foreach ($o in $output_file)

Next, I assign $a variable to Write-Host processing $o. This is saying output to the console what email address the script is currently processing.

$a = Write-Host Processing $o

I assign $b variable to the command Get-Mailbox with ID variable $o and find when it was created.

$b = get-mailbox -id $o | select whenCreated

I create an array to store both $a & $b variables in an ever clever $c variable. Then pipe | the $c array to Out-String then pipe | the data to add content. As well we need to populate EmailaccountCreationDates.txt in the directory c:\scripts\ and close off the ForEach command with the (})end bracket.

Note: This is all considered one line by PowerShell. Visually, I broke it up into multiple lines so it can be easily read later.

    $c = @(
        $o
        $b
    ) | out-string | add-content "c:\scripts\EmailaccountCreationDates.txt"
   }

Now that all of the hard work is done we are going to format the output a bit. We reuse the no longer used $b variable and run another Get-Content on EmailaccountCreationDates.txt in the directory c:\scripts\

$b = Get-Content c:\scripts\EmailaccountCreationDates.txt

Next, we assign the $text variable the $b variable with join to replace all of the spaces in the text file with this character |.

$text = $b -join '|'

Now that the text file is filled with |||||||| everywhere this is little help for us. So now we are taking the $text variable and splitting the first ones with carriage returns. When that is complete we pipe | that information again to Out-String, then pipe | one last time to add-content in a new file named EmailaccountCreationDates2.txt in directory c:\scripts\

$text -split '\|' | out-string | add-content "c:\scripts\EmailaccountCreationDates2.txt"

Lastly, we close out of the PSSession for security reasons using the previously made function Disconnect-PSEX.

Disconnect-PSEX

That is everything, here is the entire script all together.

#Connect to O365 Exchange, pull all email creation dates. 
#Created by Alan "iNet" Newingham
#Date: 09/02/2020
 
#With this function you will login to O365 web
Function Connect-PSEX {
 
   $URL = "https://ps.outlook.com/powershell"
    $Credentials = Get-Credential -Message "Enter your Office 365 admin credentials"
    $EXOSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri $URL -Credential $Credentials -Authentication Basic -AllowRedirection -Name "Exchange Online"
    Import-PSSession $EXOSession
}

#Easy enough to build-out
 a quick close
Function Disconnect-PSEX {
    Remove-PSSession -Name "Exchange Online"
}

#Run the first function to connect and authenticate to https://ps.outlook.com/powershell   
Connect-PSEX
   
#Get all Users from AD
get-ADUser | out-string | add-content "c:\scripts\adusers.txt"
 
#Extract only email addresses from the AD User Export
$input_path = "c:\scripts\adusers.txt"
$output_file = "c:\scripts\extracted_addresses.txt"
$regex = '\b[A-Za-z0-9._%%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}\b'
select-string -Path $input_path -Pattern $regex -AllMatches | %% { $_.Matches } | %% { $_.Value } > $output_file
 
#Find in 365 Online.
$output_file = (get-Content "c:\scripts\extracted_addresses.txt")
foreach ($o in $output_file)
   {
       
           $a = Write-Host Processing $o 
           $b = get-mailbox -id $o | select whenCreated
           $c = @(
               $o
               $b
           ) | out-string | add-content "c:\scripts\EmailaccountCreationDates.txt"
   }
   
$b = Get-Content c:\scripts\EmailaccountCreationDates.txt
$text = $b -join '|'
$text -split '\|' | out-string | add-content "c:\scripts\EmailaccountCreationDates2.txt"
 
Disconnect-PSEX