Back to script library
Entra / Microsoft 365 · Exchange Online

Report mail usage domains

An example of how to read mail usage data for a tenant using the Microsoft Graph PowerShell SDK.

Connect & set up

Run these once per session. All scopes are read-only unless the script makes changes.

Connect-MgGraph -Scopes ReportSettings.ReadWrite.All, Directory.Read.All, Reports.Read.All

Run it

The main script. Copy it, or download the .ps1 and run it from your console.

Connect-MgGraph -Scopes ReportSettings.ReadWrite.All, Directory.Read.All, Reports.Read.All
Write-Output "Finding user accounts to process..."
[array]$Users = Get-MgUser -Filter "assignedLicenses/`$count ne 0 and userType eq 'Member'" -ConsistencyLevel eventual -CountVariable Records -All | Sort-Object UserPrincipalName
# Check tenant usage data obfuscation setting. If it's true (names are concealed)
# reset it for this script
If ((Get-MgBetaAdminReportSetting).DisplayConcealedNames -eq $True) {
$Parameters = @{ displayConcealedNames = $False }
Update-MgBetaAdminReportSetting -BodyParameter $Parameters
$DisplayConcealedNames = $True
}
Write-Output "Fetching mail activity usage report data..."
Get-MgReportEmailActivityUserDetail -Period 'D7' -OutFile 'c:\temp\d7.csv'
Get-MgReportEmailActivityUserDetail -Period 'D30' -OutFile 'c:\temp\d30.csv'
Get-MgReportEmailActivityUserDetail -Period 'D90' -OutFile 'c:\temp\d90.csv'
Get-MgReportEmailActivityUserDetail -Period 'D180' -OutFile 'c:\temp\d180.csv'
# Import the data into arrays
[array]$D7Data = Import-CSV 'c:\temp\d7.csv' | Sort-Object 'User Principal Name'
[array]$D30Data = Import-CSV 'c:\temp\d30.csv' | Sort-Object 'User Principal Name'
[array]$D90ata = Import-CSV 'c:\temp\d90.csv' | Sort-Object 'User Principal Name'
[array]$D180Data = Import-CSV 'c:\temp\d180.csv' | Sort-Object 'User Principal Name'
# Process mailboxes
$Report = [System.Collections.Generic.List[Object]]::new()
ForEach ($User in $Users) {
[array]$D7Email = $D7Data | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}
[array]$D30Email = $D30Data| Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}
[array]$D90Email = $D90ata | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}
[array]$D180Email = $D180Data | Where-Object {$_.'User Principal Name' -eq $User.UserPrincipalName}
If ($D7Email.'Report Refresh Date') {
$ReportDate = Get-Date($D7Email.'Report Refresh Date') -format dd-MMM-yyyy
} Else {
$ReportDate = $Null }
If ($D7Email.'Last Activity Date') {
$LastActivityDate = Get-Date($D7Email.'Last Activity Date') -format dd-MMM-yyyy
} Else {
$LastActivityDate = $Null }
If ([string]::IsNullOrWhiteSpace($User.Mail)) {
$Domain = $User.UserPrincipalName.Split('@')[1]
} Else {
$Domain = $User.Mail.Split('@')[1]
}
$ReportLine = [PSCustomObject] @{
User = $User.UserPrincipalName
Name = $User.DisplayName
'Data Date' = $ReportDate
'Last Activity' = $LastActivityDate
'D7 Mail In' = $D7Email.'Receive Count'
'D7 Mail Out' = $D7Email.'Send Count'
'D30 Mail In' = $D30Email.'Receive Count'
'D30 Mail Out' = $D30EMail.'Send Count'
'D90 Mail In' = $D90Email.'Receive Count'
'D90 Mail Out' = $D90Email.'Send Count'
'D180 Mail In' = $D180Email.'Receive Count'
'D180 Mail Out' = $D180Email.'Send Count'
Domain = $Domain }
$Report.Add($ReportLine)
} # End Foreach user
# Show the data sorted by the volume of outbound mail sent by a user
$Report | Sort-Object {$_.'D180 Mail Out' -as [int]} -Descending | Out-GridView
# Reset tenant obfuscation settings to True if that's what they were before
If ($DisplayConcealedNames -eq $True) {
$Parameters = @{ displayConcealedNames = $True }
Update-MgBetaAdminReportSetting -BodyParameter $Parameters
$DisplayConcealedNames = $Null
}
# Analyze domains
[array]$Domains = Get-MgDomain | Select-Object -ExpandProperty Id
$OutputData = [System.Collections.Generic.List[Object]]::new()
ForEach ($Domain in $Domains) {
$DomainData = $Report | Where-Object {$_.Domain -eq $Domain}
$DomainSendCount = ($DomainData.'D180 Mail out' | Measure-Object -Sum).Sum
$DomainOutput = [PSCustomObject] @{
'Domain' = $Domain
'Send Count' = $DomainSendCount }
$OutputData.Add($DomainOutput)
}
# Display the domain data
$OutputData | Sort-Object 'Send Count' -Descending
Attribution