Entra / Microsoft 365 · Exchange Online
Report mail usage domains
An example of how to read mail usage data for a tenant using the Microsoft Graph PowerShell SDK.
Connect & set up
Run these once per session. All scopes are read-only unless the script makes changes.
Connect-MgGraph -Scopes ReportSettings.ReadWrite.All, Directory.Read.All, Reports.Read.All
Run it
The main script. Copy it, or download the .ps1 and run it from your console.
Connect-MgGraph -Scopes ReportSettings.ReadWrite.All, Directory.Read.All, Reports.Read.AllWrite-Output "Finding user accounts to process..."[array]$Users = Get-MgUser -Filter "assignedLicenses/`$count ne 0 and userType eq 'Member'" -ConsistencyLevel eventual -CountVariable Records -All | Sort-Object UserPrincipalName# Check tenant usage data obfuscation setting. If it's true (names are concealed)# reset it for this scriptIf ((Get-MgBetaAdminReportSetting).DisplayConcealedNames -eq $True) {$Parameters = @{ displayConcealedNames = $False }Update-MgBetaAdminReportSetting -BodyParameter $Parameters$DisplayConcealedNames = $True}Write-Output "Fetching mail activity usage report data..."Get-MgReportEmailActivityUserDetail -Period 'D7' -OutFile 'c:\temp\d7.csv'Get-MgReportEmailActivityUserDetail -Period 'D30' -OutFile 'c:\temp\d30.csv'Get-MgReportEmailActivityUserDetail -Period 'D90' -OutFile 'c:\temp\d90.csv'Get-MgReportEmailActivityUserDetail -Period 'D180' -OutFile 'c:\temp\d180.csv'# Import the data into arrays[array]$D7Data = Import-CSV 'c:\temp\d7.csv' | Sort-Object 'User Principal Name'[array]$D30Data = Import-CSV 'c:\temp\d30.csv' | Sort-Object 'User Principal Name'[array]$D90ata = Import-CSV 'c:\temp\d90.csv' | Sort-Object 'User Principal Name'[array]$D180Data = Import-CSV 'c:\temp\d180.csv' | Sort-Object 'User Principal Name'# Process mailboxes$Report = [System.Collections.Generic.List[Object]]::new()ForEach ($User in $Users) {[array]$D7Email = $D7Data | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}[array]$D30Email = $D30Data| Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}[array]$D90Email = $D90ata | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}[array]$D180Email = $D180Data | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}If ($D7Email.'Report Refresh Date') {$ReportDate = Get-Date($D7Email.'Report Refresh Date') -format dd-MMM-yyyy} Else {$ReportDate = $Null }If ($D7Email.'Last Activity Date') {$LastActivityDate = Get-Date($D7Email.'Last Activity Date') -format dd-MMM-yyyy} Else {$LastActivityDate = $Null }If ([string]::IsNullOrWhiteSpace($User.Mail)) {$Domain = $User.UserPrincipalName.Split('@')[1]} Else {$Domain = $User.Mail.Split('@')[1]}$ReportLine = [PSCustomObject] @{User = $User.UserPrincipalNameName = $User.DisplayName'Data Date' = $ReportDate'Last Activity' = $LastActivityDate'D7 Mail In' = $D7Email.'Receive Count''D7 Mail Out' = $D7Email.'Send Count''D30 Mail In' = $D30Email.'Receive Count''D30 Mail Out' = $D30EMail.'Send Count''D90 Mail In' = $D90Email.'Receive Count''D90 Mail Out' = $D90Email.'Send Count''D180 Mail In' = $D180Email.'Receive Count''D180 Mail Out' = $D180Email.'Send Count'Domain = $Domain }$Report.Add($ReportLine)} # End Foreach user# Show the data sorted by the volume of outbound mail sent by a user$Report | Sort-Object {$_.'D180 Mail Out' -as [int]} -Descending | Out-GridView# Reset tenant obfuscation settings to True if that's what they were beforeIf ($DisplayConcealedNames -eq $True) {$Parameters = @{ displayConcealedNames = $True }Update-MgBetaAdminReportSetting -BodyParameter $Parameters$DisplayConcealedNames = $Null}# Analyze domains[array]$Domains = Get-MgDomain | Select-Object -ExpandProperty Id$OutputData = [System.Collections.Generic.List[Object]]::new()ForEach ($Domain in $Domains) {$DomainData = $Report | Where-Object {$_.Domain -eq $Domain}$DomainSendCount = ($DomainData.'D180 Mail out' | Measure-Object -Sum).Sum$DomainOutput = [PSCustomObject] @{'Domain' = $Domain'Send Count' = $DomainSendCount }$OutputData.Add($DomainOutput)}# Display the domain data$OutputData | Sort-Object 'Send Count' -Descending
Attribution
Author
Office365itpros