Discovery Data

The source audit discovers the following data from the source tenant.

Recipients

Each discovered recipient includes:

• displayName — user's display name
• userPrincipalName — UPN
• mail — primary SMTP address
• recipientType — UserMailbox, SharedMailbox, MailContact, etc.
• mailboxSizeBytes — total mailbox size in bytes
• itemCount — total number of items
• oneDriveSizeBytes — OneDrive for Business usage
• licenseCount — number of assigned licences
• licenseSkuIds — array of assigned SKU IDs
• licenseDetails — JSON with full licence assignment details

Groups

• displayName — group name
• groupTypes — Microsoft 365, Security, Distribution, etc.
• memberCount — number of members
• ownerCount — number of owners
• mail — group email address (if mail-enabled)

Tenant Subscriptions

Discovered via /subscribedSkus:

• skuPartNumber — SKU identifier (e.g. ENTERPRISEPACK)
• skuId — SKU GUID
• capabilityStatus — Enabled, Suspended, etc.
• consumedUnits — number of assigned licences
• prepaidUnitsEnabled — total purchased seats

Delegations

• mailbox — the mailbox being delegated
• delegate — the user with access
• permissionType — SendAs, SendOnBehalf, FullAccess, FolderPermission
• folderName — (for folder permissions) which folder is shared
• accessRights — specific rights granted