EMAIL OVERRIDE INVENTORY

Purpose: collect a read-only starting-point inventory for ONE named mailbox and
five Exchange Online configuration areas. This is an operational aid, not a
scanner that declares a tenant safe or diagnoses a specific message automatically.

1. Review the script.
2. Use Microsoft's ExchangeOnlineManagement module and an authorized account.
3. Connect-ExchangeOnline -UserPrincipalName admin@contoso.com
4. .\Get-EmailOverrideInventory.ps1 -Mailbox lab@contoso.com
5. Read the JSON report locally, including every section Status and ManualChecks.

QueriesSucceeded means those commands returned successfully within your RBAC scope.
It does not mean the tenant was fully audited. Partial means at least one query
was unavailable or failed. Empty successful results also need scope verification.

The output contains addresses, policy names and configuration details. Keep it in
your investigation record; do not upload it to public tools or the blog. The script
contains no tenant-specific addresses, secrets, connection or write commands.

Validation for this release: local tests with simulated command output in PowerShell
7 covered empty results, unavailable commands, query failure, 1,201 transport rules
and rejection of wildcard mailbox input. This script was not run against the lab
tenant. Review it and verify your Exchange connection and RBAC scope before use.

To remove the generated local files, delete the output folder after retaining any
required case evidence. No tenant rollback is needed because the script is read-only.