Export (0) Print
Expand All
5 out of 6 rated this helpful - Rate this topic

Reporting and Message Trace in Exchange Online Protection

Exchange 2013
 

Applies to: Exchange Online Protection

Topic Last Modified: 2014-03-24

Microsoft Exchange Online Protection (EOP) offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools available to EOP admins.

 

Feature

Description

Where you can find it

For more information

Reports in the Office 365 admin center

The following reports about messaging data is available in the Microsoft Office 365 admin center:

  • Protection   View information about spam and malware sent to and from your organization, and the total volume of mail sent to and from your organization.

  • Rules   View information about custom rules that affected mail sent to and from your organization.

In the Office 365 admin center, click Reports and then access the report you want to view.

For detailed information about a specific report, open the report and hover over the information link next to the report title.

For more information about the Reports page in the Office 365 admin center, see View and download reports about service usage in Office 365.

Detailed protection reports using the Excel reporting workbook

The Excel 2013 reporting workbook lets you view both summary and detailed email protection reports. The workbook allows deeper analysis on the summary data through the use of filters and slicers. This allows you to take different views of the summarized data. If you see a trend or anomaly in the summary data, you can then click through from the summary to detail tabs to view the individual messages that contributed to the summary.

After it is installed, the workbook can be accessed directly using Excel 2013.

For more overview information and links to download and install the workbook, see Mail Protection Reports for Office 365.

For information about how to use the workbook, see Mail Protection Reports Using the Excel Reporting Workbook.

Message tracing

Follows email messages as they travel through EOP. You can determine if an email message was received, rejected, deferred, or delivered by the service. It also shows what actions have occurred to the message before reaching its final status. Obtaining detailed information about a specific message lets you efficiently answer your user’s questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.

In the Exchange admin center (EAC), go to Mail flow > Message trace.

Trace an Email Message

Audit logging

Tracks specific changes made by admins to your organization. These reports can help you troubleshoot configuration issues or find the cause of security or compliance-related problems.

In the EAC, go to Compliance management > Auditing.

Auditing Reports in EOP

The following table describes when EOP reporting and message trace data is available and for how long.

 

Report type

Data available for (look back period)

Latency

Office 365 admin center summary reports

60 days

Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.

Excel 2013 workbook summary report

180 days

Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.

Excel 2013 workbook detail data

7 days

Data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental aggregated changes may occur for up to 5 days.

Message trace data for messages less than 7 days old

7 days

When you run a message trace, the messages should appear within 5-30 minutes.

Message trace data for messages greater than 7 days old (report is only available as a download)

90 days

Results may take up to a few hours.

Note: You can search for data for up to 90 days old, but it must be at least 24 hours old

NoteNote:
Data availability and latency is the same whether requested via the UI (Office 365 admin center or the Excel 2013 workbook) or remote PowerShell.
 
Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.