Searching for an Email addresses using PowerShell | Where Filter | Office 365 | Part 9#13

The current article we review the PowerShell command syntax, that we use for “constructing” a query, for searching specific E-mail address using the PowerShell where filter.

The thing that we need to know before we start the search for E-mail address

In this section, I would like to briefly review the main points that relate to the task of performing a search for E-mail addresses in an Office 365 environment.

1. Where to perform the search?
As mentioned, in an Office 365 environment is a “mesh” of different environment that constructs the logical term “Office 365.”

The information that we look for can be associated with Office 365 users who are located in the Azure Active Directory or, associated with Exchange Online recipients that are hosted at the Exchange Online infrastructure.

So, the first question that we need to answer is “where” we want to perform the search?

2. Exchange Online | What are the “recipients type” that we want to query?
Exchange Online includes a substantial number of different recipient’s type.

In a utopian world, we could use one “magical” PowerShell cmdlet, that will help us to scan and fetch information about all the existing Exchange Online recipients. The reality is a little more complicated because, unfortunately, there is no such command.

To be able to address all the available Exchange Online recipient, we will need to use a “Mixture” of PowerShell cmdlets that will address different types of Exchange Online recipients.

3. The term “E-mail address”
In the Office 365 environment, the term “E-mail address,” can be translated to a wide range of “address,” that use an identical naming structure as the “SMTP E-mail address.”

For example,

• Office 365 user login name (UPN) is based on the naming structure of SMTP E-mail addresses.
• SIP address (Skype for business users) uses the same naming structure of SMTP E-mail addresses.

4. What PowerShell syntax to use for performing the search?

In the current article, we will use the PowerShell Where statement as a tool for performing a query, that will scan existing Office 365 objects (Office 365 user account and Exchange Online recipient), and “fetch” for us the object that answers specific criteria.

The E-mail address as a “Text string”

PowerShell offers many methods for implementing the task of – looking for a specific “text string.” In our scenario, the “text string” that we look for is an “E-mail address.”
When we say that we are looking for an E-mail address, the term “E-mail address” can be realized as:

• The “Left part” of an E-mail address. This is that part that includes the recipient Alias name. We relate to the “left part” of the E-mail address when we look for information about specific Alias name\s.
• The “Right part” of an E-mail address. This is the part that includes the domain name suffix. We relate to the “Right part” of an E-mail address when we look for information
  about E-mail address with a specific domain name.
• The “right part” + the “left part.” We relate to the booth of the E-mail address parts, in a scenario in which we search for a specific E-mail address.

Using PowerShell for searching a specific E-mail address using the Where statement

In the following diagram, we can see a basic structure of a PowerShell command, in which we look for E-mail addresses that have a specific domain name suffix.

The “PowerShell query” is created by using the Where filter.

The different “parts” of the PowerShell command syntax

Part 1#4 – Exchange Online recipient object

The first part is the part in which we select the specific Exchange Online recipient. In our example, the Exchange recipient “type” is Exchange mailbox.

Part 2#4 – The Where filter

In this part, we use the PowerShell Where statement + the definition of the “query filter” or in other words- the “search condition.”

The PowerShell Where statement, include the following parts:

To perform the required search, that defines a condition in which we search only for an E-mail address that has a specific character such as – specific domain name suffix, we use the PowerShell statement Where.

The PowerShell query “resides” between the curly brackets.

In our scenario, we query the Azure Active Directory infrastructure + Exchange Online infrastructure.

• When we query Exchange Online infrastructure, we “address” the Exchange Online recipient property named EmailAddresses.
• When we query Azure Active Directory infrastructure, we “address” the Office 365 user property named UserPrincipalName and the property ProxyAddresses.

The PowerShell operator whom we use

In a scenario in which we look for a specific E-mail address, we can choose a couple of options of the PowerShell operators that we use.

For example, we can use the PowerShell operator eq (equal) or the PowerShell operator like.

The PowerShell operator “Like” as the name implies, we search for E-mail addresses that are “like” the E-mail address that we provide.

In our specific scenario, an Exchange Online recipient could “use” the specific E-mail address
as an “SMTP E-mail address” or “SIP address.”

For example, when using the PowerShell operator “like,” looking for the following E-mail addresses Bob@o365info.com, the PowerShell command display result if she finds SMTP E-mail address that includes that “search string” or SIP address that includes the “search string.”

In case that we use the Comparison Operators “like,” we must use the asterisk character (*)

• To be able to define a condition, in which we want to find a text string that “begin” with defined characters, but we don’t know how it “end,” we will add the asterisk character (*) at the end of the text string that we “provide” to the PowerShell command.
• To be able to define a condition, in which we want to find a text string that “end” with defined characters, but we don’t know how it “begins,” we will add the asterisk character (*) at the begging of the text string that we “provide” to the PowerShell command.

As we can see in the picture, the PowerShell operator “Like” and the asterisk character (*) are good friends.

Another example of a PowerShell operator whom we can use is the operator – eq (equal).

When we want to “tell” PowerShell that we want to perform a search that looks for a “perfect match,” we use the operator eq (equal).

For example, in case that we want to look for the following E-mail – Bob@o365info.com but display information only if the address is an SMTP address, we will use the following PowerShell syntax:

If you feel overloaded from all the information and the various searches that we need to perform, I have created a PowerShell menu based script named
Manage E-mail address.ps1, that will simplify the task of searching for an E-mail address with a specific domain name suffix.

Part 3#4 – the displayed object properties “fields”

Each of the recipient objects such as, Exchange Online mailbox have many properties.

After the Where filter gets the required information, (in our case, an Exchange recipient who answers a specific condition), the “PowerShell output” displays a recipient or a recipient list.

Each of the recipients will be displayed + using “predefined object properties.”

Most of the time, we would like to change this “default,” and “inform” PowerShell, what are the specific recipient properties (attributes) that are relevant to us.

For example, in a scenario in which we look for recipients who have a specific E-mail address, the main properties that are relevant to us are:

• The recipient name such as – Display name.
• The type of the recipient (Recipienttype) such as mailbox user or contact.
• The E-mail addresses that are associated with the specific recipient.

To “inform” the PowerShell command, what are the specific properties that we wish to display (or export), we use PowerShell parameters such as Select, FL (Format-List) or FT (Format-Table).

Each of the “properties” that we wish to display, will be separated by a comma character.

Part 4#4 – Export the results.

By default, the results from the PowerShell query displayed on the PowerShell console.

Regarding the task of – getting information about Exchange Online recipients E-mail address (or Office 365 UPN name), in many scenarios, we will need to export the information to files.”

Storing the information in files, enable us to “manipulate” the data by using filters, specific views and in addition, edit and manage the data.

To export the information about the E-mail address, the was created from the PowerShell Where filter, we will need to provide the specific file type that we need such as – CSV, TXT or HTML.

The next article in the current article series

Searching Email addresses with a specific domain name suffix Using PowerShell | Office 365 | Part 10#13