Defender Email Tracker Automation

I need a hands-free workflow that pulls every newly reported email from Microsoft Defender for Office 365 and immediately reflects its current Status, Threat level and Action taken inside my existing Azure-hosted tracker. Here is how I picture it working: an Azure Function, Logic App or a well-structured PowerShell/Graph API script queries Defender on a schedule, identifies any messages that are not yet recorded (or whose state has changed), and then writes or updates the corresponding row in my Azure data store. The three columns that must stay accurate are: • Status of each email • Threat level • Action taken The solution should: • Authenticate securely with Defender (Modern OAuth, no hard-coded secrets) • De-duplicate entries so the tracker never shows the same message twice • Log every run and surface any failures in Azure Monitor (or another lightweight option you recommend) • Be packaged so I can deploy it to a new subscription in minutes, with clear step-by-step instructions Deliverables: 1. Complete source code / workflow definition 2. Deployment guide in Markdown 3. One short video or screenshots proving the tracker auto-updates after a test email is reported If you can add incremental enhancements—such as optional sender or attachment metadata extraction—please flag that in your proposal, but keep the core logic lean and reliable.