Office365 User Scraper

Export everyone in your Office 365 organisation into a .csv in seconds, straight from your browser, without any admin tools.

This project reverse engineers the Office 365 Outlook webapp API, collecting all users in an Outlook directory via a single API request. All you have to do is obtain a BaseFolderID and paste JavaScript code into your browser console. All users within that BaseFolder will be downloaded to a .csv file on your computer.

The x-owa-canary cookie is automatically retrieved from your browser and used to authenticate the API request. The API response is then parsed and entered into a 2d array. This array is then converted into a comma-separated-value format which is then downloaded as a .csv file via your browser.

Sample csv

Below is the data structure of the .csv file generated, formatted as a Markdown table (information redacted):

PersonaId	DisplayName	EmailAddress
AAUQAGAxxxxxxxxxxxxxxxxT2rY=	Aa___ P___	[email protected]
AAUQAP2xxxxxxxxxxxxxxxxVfSs=	Ab___ E___	[email protected]
AAUQAPNxxxxxxxxxxxxxxxxoI3w=	Ab___ G___	[email protected]
AAUQABGxxxxxxxxxxxxxxxxqDhw=	Ac___ C___	[email protected]
AAUQAI7xxxxxxxxxxxxxxxxHsjQ=	Ad___ R___	[email protected]
AAUQAHKxxxxxxxxxxxxxxxxqxWY=	AF___ R___	[email protected]
AAUQAFQxxxxxxxxxxxxxxxxx3MU=	Ai___ N___	[email protected]
AAUQABdxxxxxxxxxxxxxxxxsi1w=	Al___ D___	[email protected]

Features

• Retrieve full name, email address and unique Persona Id by default
• Export all users to a .csv file
• Very portable, simply paste code into your browser console
• Quiet network traffic (only 1 request)
• Automatically retrieve the required cookie for API authentication
• Easily extract more information from the API response (see appendix)

Usage

1. Visit https://outlook.office.com in your browser.
2. Press F12 to launch the "Developer Tools" popup.
3. Navigate to the "Console" tab within the Developer Tools popup.
4. Paste this JavaScript code into the Developer Tools Console (don't execute it yet).
5. Edit the code you just pasted and change const base_folder_id = "" so that your BaseFolderId is within the quotation marks. Please see below for how to get a BaseFolderId. This is the line you should be changing:

   ous/scrape-outlook-contacts.js

   Line 9 in ea84003

   const base_folder_id = "a000a000-0aa0-0a0a-aa00-a000a0000a0a"

6. Press Enter to execute the code in the Console. Userdata will be printed to the console and downloaded to your computer shortly. If something went wrong, you will receive a JavaScript error in the Console, so make sure your Console is not filtering out errors.

How to get a BaseFolderId

1. Visit https://outlook.office.com/people/.
2. Press F12 to launch the "Developer Tools" popup for this tab.
3. In Developer Tools, go to the "Network" tab.
4. Go back to your Outlook browser tab (opened in step 1). On the left you should see a list of user directories (this may be hidden behind the burger menu). Click on the user directory you want to scrape. Many new requests should pop up in your Developer Tools Network tab once you do this.

5. On the Developer Tools Network tab, identify the first request that occurred when you completed step 4. The request URL/file should look similar to: service.svc?action=FindPeople&app=People&n=33. (If you find it difficult identifying which request occurred first, try clearing the Network tab request list (bin icon) and then performing step 4 again. The correct request will then most likely be the first one in the list).

6. Right click that request and from the dropdown, select:
   • Chrome: "Copy" -> "Copy as fetch".
   • Firefox: "Copy" -> "Copy Request Headers".
7. Paste those request headers into any text editor and then identify the x-owa-urlpostdata header.
8. Copy the contents of the x-owa-urlpostdata header and paste them into a URL decoder such as: https://www.freeformatter.com/url-encoder.html. This step isn't necessary, but makes it easier to read the header if you are unfamiliar with URL escape codes.
9. Copy the decoded header content into any text editor, and identify the BaseFolderId key.
10. Copy the Id child-key (["BaseFolderId"]["Id"]) value. This should look something like a000a000-0aa0-0a0a-aa00-a000a0000a0a.
11. The value you just copied is your BaseFolderId.

Appendix

Example API response

The API responds with a list of users. Below is the data structure returned per user (some information redacted):

[
    {
      "__type": "PersonaType:#Exchange",
      "PersonaId": {
        "__type": "ItemId:#Exchange",
        "Id": "AAUQAGAxxxxxxxxxxxxxxxxT2rY="
      },
      "PersonaTypeString": "Person",
      "CreationTimeString": "0001-01-02T00:00:00Z",
      "DisplayName": "Aa___ P___",
      "DisplayNameFirstLast": "Aa___ P___",
      "DisplayNameLastFirst": "Aa___ P___",
      "FileAs": "",
      "GivenName": "Aa___",
      "Surname": "P___",
      "CompanyName": "My Domain",
      "EmailAddress": {
        "Name": "Aa___ P___",
        "EmailAddress": "[email protected]",
        "RoutingType": "SMTP",
        "MailboxType": "Mailbox"
      },
      "EmailAddresses": [
        {
          "Name": "Aa___ P___",
          "EmailAddress": "[email protected]",
          "RoutingType": "SMTP",
          "MailboxType": "Mailbox"
        }
      ],
      "ImAddress": "sip:[email protected]",
      "WorkCity": "Watford",
      "RelevanceScore": 2147483647,
      "AttributionsArray": [
        {
          "Id": "0",
          "SourceId": {
            "__type": "ItemId:#Exchange",
            "Id": "AAUQAGAxxxxxxxxxxxxxxxxT2rY="
          },
          "DisplayName": "GAL",
          "IsWritable": false,
          "IsQuickContact": false,
          "IsHidden": false,
          "FolderId": null,
          "FolderName": null,
          "IsGuest": false
        }
      ],
      "ADObjectId": "aa000000-a0aa-00a0-0000-aaa000a0aaa0"
    }
]

x-owa-urlpostdata decoded

x-owa-urlpostdata is a header used in the POST request to the Outlook API. We customise the following values in this header:

• Offset: Starting index of users to send. An offset of 20 will not return the first 20 users. By default, an offset of 0 is used to return all users.
• MaxEntriesReturned: Maximum number of users to be returned by the API. See the Example API response appendix to view the information returned per user. By default, we request a maximum of 1000 users to be returned. However, you can increase this if you need to.
• BaseFolderId Id: This is the Outlook userlist/directory to return in the API response. This is tedious to obtain, but is essential and must be valid or the API request will fail.

{
    "__type": "FindPeopleJsonRequest:#Exchange",
    "Header": {
        "__type": "JsonRequestHeaders:#Exchange",
        "RequestServerVersion": "V2018_01_08",
        "TimeZoneContext": {
        "__type": "TimeZoneContext:#Exchange",
        "TimeZoneDefinition": {
            "__type": "TimeZoneDefinitionType:#Exchange",
            "Id": "GMT Standard Time"
        }
        }
    },
    "Body": {
        "IndexedPageItemView": {
        "__type": "IndexedPageView:#Exchange",
        "BasePoint": "Beginning",
        "Offset": Offset,
        "MaxEntriesReturned": MaxEntriesReturned
        },
        "QueryString": null,
        "ParentFolderId": {
        "__type": "TargetFolderId:#Exchange",
        "BaseFolderId": {
            "__type": "AddressListId:#Exchange",
            "Id": BaseFolderId
        }
        },
        "PersonaShape": {
        "__type": "PersonaResponseShape:#Exchange",
        "BaseShape": "Default",
        "AdditionalProperties": [
            {
            "__type": "PropertyUri:#Exchange",
            "FieldURI": "PersonaAttributions"
            },
            {
            "__type": "PropertyUri:#Exchange",
            "FieldURI": "PersonaTitle"
            },
            {
            "__type": "PropertyUri:#Exchange",
            "FieldURI": "PersonaOfficeLocations"
            }
        ]
        },
        "ShouldResolveOneOffEmailAddress": false,
        "SearchPeopleSuggestionIndex": false
    }
}

Special thanks

• @edubey - Inspiration for the project.
• @freddierick - Async fix to make everything wait for the API fetch() request to complete.