Session objective
Identify documents Hannah Foster created or edited over the last two weeks, using Microsoft sources instead of Salesforce.
Window
Strict two-week window used: 2026-05-20 through 2026-06-03.
Sources checked
- Microsoft Graph user OneDrive drive/root and root children endpoints.
- Microsoft Graph insights/used and insights/shared.
- Microsoft Graph Sent Items and attachments since 2026-05-20.
- Microsoft Search query endpoint for driveItem results involving Hannah Foster / hfoster@demandsam.com and recent create/modified windows.
- Office 365 Management Activity API audit-feed probe for SharePoint and General audit content.
Findings
- Direct OneDrive drive endpoints returned HTTP 503 UnknownError for Hannah's user drive.
- insights/used had zero Hannah document rows with last accessed or last modified dates on or after 2026-05-20.
- insights/shared had recent items shared to Hannah or visible to Hannah, but none shared by Hannah in the strict 2026-05-20 to 2026-06-03 window.
- Hannah sent messages since 2026-05-20 had zero attachments.
- Microsoft Search for hfoster@demandsam.com returned one older/unrelated runbook hit, not a recent Hannah-created or Hannah-edited document.
- Microsoft Search for Hannah Foster returned older hits, none created or modified in the strict two-week window.
- Broad recent create/modified searches returned other users' files, not Hannah-specific files.
- Office 365 Management Activity feed was blocked with AF10001 missing expected permission.
Important context