Table of contents
Outlook Email
WorkSights captures Outlook email activity using Microsoft's Unified Audit Log, which records high-level mailbox actions from Exchange Online. These signals give organizations visibility into communication behavior without exposing message content.
Microsoft does not provide APIs or audit fields that include subject lines, recipients, or email bodies. WorkSights is designed to operate fully within those boundaries.
For connection steps, see Connecting Microsoft 365.
What WorkSights Receives
WorkSights processes two types of Exchange audit signals.
Sent email events: When a mapped user sends an email through Outlook, Exchange Online logs a send action. WorkSights receives the user identity and the timestamp of the send action. Subject lines, recipients, and message content are not available from Microsoft and are never received.
Mailbox access events: When a user opens Outlook or loads their mailbox, Exchange generates a mailbox access event. WorkSights receives that the mailbox was accessed and when. No information about which emails were viewed or interacted with is ever received.
How Outlook Email Activity Appears
Sent email events appear as short scored entries on the user's daily timeline. Mailbox access events appear as lightweight non-scored markers. Both reflect communication activity without implying content or duration.
Overnight processing removes noise from repeated or system-generated access events so timelines reflect genuine user activity.
Data Notes
These constraints come from Microsoft's data model, not from limitations in WorkSights:
- No subject lines are provided
- No recipients or header metadata are included
- No message bodies or attachments are accessible
- Mailbox access events confirm only that the mailbox was opened, not what was viewed
Activity appears only for mapped users. Correct user mapping ensures all Outlook events are attributed to the right person.
Troubleshooting
If Outlook email activity is not appearing as expected:
- Confirm the Microsoft 365 tenant is connected and the affected user is mapped in WorkSights.
- Sent email events and mailbox access events are processed via Exchange Online and do not require audit logging to be active.
- If only some users are missing activity, check that their Microsoft 365 and WorkSights email addresses match.
- For persistent issues, contact support via the in-app chat.