Monitoring, reporting, and message tracing in Exchange Online
Exchange Online offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools that are available to Exchange Online administrators.
For a mapping of reports from the old Microsoft 365 admin center, see Where did my Office 365 report go?
|Feature||Description||Where you can find it||For more information|
|Usage reports in the Microsoft 365 admin center||Office 365 groups activity: View information about the number of Office 365 groups that are created and used.
Email activity: View information about the number of messages sent, received and read in your whole organization, and by specific users.
Email app usage: View information about the email apps that are connecting to Exchange Online. This include the total number of connections for each app, and the versions of Outlook that are connecting.
Mailbox usage: View information about storage used, quota consumption, item count, and last activity (send or read activity) for mailboxes.
|In the Microsoft 365 admin center at https://portal.office.com/adminportal/home, click Reports > Usage. At the top of the dashboard, click Select a report. In the in the drop-down list that appears, make one of these selections: Office 365 section: Office 365 groups activityExchange section: Email activityEmail app usageMailbox usage||Office 365 Reports in the admin center - Office 365 groups
Office 365 Reports in the Admin Center - Email activity
Office 365 Reports in the Admin Center - Email apps usage
Office 365 Reports in the Admin Center - Mailbox usage
|Security & compliance reports in the Microsoft 365 admin center||These enhanced reports provide an interactive reporting experience for Exchange Online admins, which includes summary information, and the ability to drill down for more details.
Data loss prevention (DLP): View information about DLP policies and rules that affect messages containing sensitive data as they enter and leave your organization.
Note: DLP is only available in certain Exchange Online subscription plans. For information, see the Data Loss Prevention entries in the Exchange Online Service Description.
Advanced Threat Protection (ATP): View information about safe links and safe attachments that are part of ATP.
Note: ATP is available in Office 365 Enterprise E5, but you can also purchase ATP as an add-on to other subscription plans. For more information, see Office 365 Advanced Threat Protection Service Description.
Exchange Online Protection (EOP): View information about malware detections, spoofed mail, spam detections, and mail flow to and from your organization.
|In the Office 365 Security & Compliance Center at https://protection.office.com, click Reports > Dashboard. Select one of the reports that are available on the page: DLP reports: DLP policy matches and DLP false positives and overrides. ATP reports: ATP file types, ATP message disposition, and Threat protection status. EOP reports: Malware detections, Top malware, Top senders and recipients, Spoof mail, Spam detections, and Sent and received mail.||View the reports for data loss prevention
View reports for Advanced Threat Protection and Exchange Online Protection
|Custom reports using Microsoft Graph||Programmatically create the reports that are available in the Microsoft 365 admin center by using Microsoft Graph||n/a||The subtopics of Working with Office 365 usage reports in Microsoft Graph|
|Custom reports using reporting web services||Programmatically create reports from the available Exchange Online PowerShell reporting cmdlets by using REST/ODATA2 query filtering.
Note: Many of the original Exchange Online PowerShell reporting cmdlets have been deprecated and replaced by similar reports in Microsoft Graph. For more information, see Reporting cmdlets in Exchange Online.
|https://reports.office365.com/ecp/reportingwebservice/reporting.svc||Office 365 Reporting Web Services|
|Message trace||Follows email messages as they travel through your Exchange Online organization. You can determine if an email message was received, rejected, deferred, or delivered by the service. It also shows what actions were taken on the message before it reached its final status.
You can use this information to efficiently answer your user's questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.
|In the Microsoft 365 admin center at https://portal.office.com/adminportal/home, click Admin centers > Exchange. In the new Exchange admin center page that opens, go to Mail flow > Message trace.||Trace an email message
To learn how to use message trace and other tools for troubleshooting, watch the video at Find and fix email delivery issues as an Office 365 for business admin.
|Audit logging||Tracks specific changes made by admins to your Exchange Online organization. These reports help you meet regulatory, compliance, and litigation requirements.||In the Microsoft 365 admin center at https://portal.office.com/adminportal/home, click Admin centers > Exchange Online Protection. In the new Exchange admin center page that opens, go to Compliance management > Auditing.||Exchange auditing reports|
Reporting and message trace data availability and latency
The following table describes when Exchange Online reporting and message trace data is available and for how long.
|Report type||Data available for (look back period)||Latency|
|Mailbox summary reports||60 days||Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.|
|Mail protection summary reports||90 days||Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.|
|Mail protection detail reports||90 days||For detail data that's less than 7 days old, data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.
To view detail reports for messages that are greater than 7 days old, results may take up to a few hours.
|Message trace data||90 days||When you run a message trace for messages that are less than 7 days old, the messages should appear within 5-30 minutes.
When you run a message trace for messages that are greater than 7 days old, results may take up to a few hours.
Data availability and latency is the same whether requested via the Microsoft 365 admin center or remote PowerShell.
Send feedback about: