Monitoring, reporting, and message tracing in Exchange Online
Exchange Online offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools that are available to Exchange Online administrators.
|Reports in the Microsoft 365 admin center||Email activity||In the Microsoft 365 admin center, go to Show all (if necessary), click Reports > Usage, and then select one of the reports on the page:
|Reports in the Microsoft Purview compliance portal||DLP reports1||In the Microsoft Purview compliance portal (https://security.microsoft.com), go to Reports, and then select one of the available reports on the page. To go directly to the Reports page, use https://compliance.microsoft.com/reports.|
|Reports in the Microsoft 365 Defender portal||View Defender for Office 365 reports2||In the Microsoft 365 Defender portal (https://security.microsoft.com), go to Reports > Email & collaboration > Email & collaboration reports, and then select one of the available reports on the page. To go directly to the Reports page, use https://security.microsoft.com/emailandcollabreport.|
|Reports using Microsoft Graph||Programmatically create the reports that are available in the Microsoft 365 admin center by using Microsoft Graph. For more information, see the following topics:||n/a|
|Reports using reporting web services||Programmatically create reports from the available Exchange Online PowerShell reporting cmdlets by using REST/ODATA2 query filtering.3
For more information, see Reporting Web Services.
|Message trace||Message trace in the modern Exchange admin center||In the Exchange admin center (https://admin.exchange.microsoft.com), go to Mail flow > Message trace.
Note: The Exchange message trace link in the Microsoft 365 Defender portal opens message trace in the modern EAC.
|Audit logging||Search the audit log in the Microsoft Purview compliance portal)||In the Microsoft Purview compliance portal (https://compliance.microsoft.com), go to Solutions > Audit > Search tab on the Audit page.|
1 DLP is only available in certain Exchange Online subscription plans. For information, see the Data Loss Prevention entries in the Exchange Online Service Description.
2 Defender for Office 365 is available in Office 365 Enterprise E5, but you can also purchase Defender for Office 365 as an add-on to other subscription plans. For more information, see the Microsoft Defender for Office 365 Service Description.
3 Many of the original reporting cmdlets in Exchange Online PowerShell have been deprecated (the cmdlets are available, but they don't return useful data). For a list of available and unavailable reporting cmdlets, see Exchange reporting cmdlets.
Reporting and message trace data availability and latency
The following table describes when Exchange Online reporting and message trace data is available and for how long.
|Report type||Data available for (look back period)||Latency|
|Mailbox summary reports||60 days||Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.|
|Mail protection summary reports||90 days||Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.|
|Mail protection detail reports||90 days||For detail data that's less than 7 days old, data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.
To view detail reports for messages that are greater than 7 days old, results may take up to a few hours.
|Message trace data||90 days||When you run a message trace for messages that are less than 7 days old, the messages should appear within 5-30 minutes.
When you run a message trace for messages that are greater than 7 days old, results may take up to a few hours.
Data availability and latency doesn't depend on the user interface (it's the same in the admin centers as in PowerShell).