Update security-mailboxevidence.md

Author: JarbasHorst

api-reference/beta/resources/security-mailboxevidence.md

@@ -1,6 +1,6 @@
 ---
 title: "mailboxEvidence resource type"
-description: "A mailbox that is reported in the alert as evidence."
+description: "Represents a mailbox that is reported in the alert as evidence."
 ms.date: 09/09/2021
 author: "BenAlfasi"
 ms.localizationpriority: medium
@@ -14,7 +14,7 @@ Namespace: microsoft.graph.security
 
 [!INCLUDE [beta-disclaimer](../../includes/beta-disclaimer.md)]
 
-A mailbox that is reported in the alert as evidence.
+Represents a mailbox that is reported in the alert as evidence.
 
 Inherits from [alertEvidence](../resources/security-alertevidence.md).
 
@@ -23,6 +23,7 @@ Inherits from [alertEvidence](../resources/security-alertevidence.md).
 |:---|:---|:---|
 |displayName|String|The name associated with the mailbox.|
 |primaryAddress|String|The primary email address of the mailbox.|
+|upn|String|TODO|
 |userAccount|[microsoft.graph.security.userAccount](../resources/security-useraccount.md)|The user account of the mailbox.|
 
 ## Relationships
@@ -49,10 +50,9 @@ The following JSON representation shows the resource type.
   "tags": [
     "String"
   ],
-  "primaryAddress": "String",
   "displayName": "String",
-  "userAccount": {
-    "@odata.type": "microsoft.graph.security.userAccount"
-  }
+  "primaryAddress": "String",
+  "upn": "String",
+  "userAccount": {"@odata.type": "microsoft.graph.security.userAccount"}
 }
-```
+```