Session objective
Use Microsoft Graph to look beyond Salesforce for Hannah Foster work activity: Outlook usage, Teams, SharePoint/OneDrive, and email evidence involving Sara Collins.
Methods
- Microsoft Graph user lookup confirmed Sara Collins as SCollins@kylawoffice.com.
- Queried Hannah mailbox Sent Items since 2026-05-13.
- Queried Hannah mailbox for direct messages from Sara Collins since 2026-05-13.
- Queried Teams joined teams and chats for Hannah.
- Queried recent Teams chat messages in chats updated since 2026-05-13, filtering for messages authored by Hannah.
- Queried Microsoft insights used/shared for SharePoint/OneDrive and mail attachment activity.
- Microsoft 365 Reports endpoints for email, Teams, SharePoint, and OneDrive activity returned 400 Request Too Long with this app token, so those report CSVs were not used.
Findings
- Outlook: Hannah sent 10 messages since 2026-05-13.
- Sara direct inbound: 3 messages from SCollins@kylawoffice.com to Hannah since 2026-05-13.
- Sara-related thread evidence included Potential Client - Following Up for 506604, State Bar of Texas / Solicitation and Barratry, Texas Penal Code / FindLaw, scanned docs, and broader list emails where both Hannah and Sara were recipients.
- Teams: Hannah is a member of the UPS Cases Team.
- Teams: Graph returned 45 chats involving Hannah, 10 updated since 2026-05-13.
- Teams message probe: recent chats were readable, but no messages authored by Hannah were found in the recent chat messages checked.
- SharePoint/OneDrive used insights: last clear recent personal OneDrive item was Under Kentucky law.docx, accessed/modified 2026-05-13T22:17:09Z.
- SharePoint/OneDrive shared insights: Hannah shared Mehr Complaint Draft and Mehr Discovery by email attachment on 2026-05-18 under subject Mehr Drafts, and shared Copier Scans_20260513_143830.pdf on 2026-05-13.
Interpretation