Export (0) Print
Expand All

Reporting and message trace in Exchange Online Protection

Exchange 2013
 

Applies to: Exchange Online Protection, Exchange Online

Topic Last Modified: 2014-04-14

Microsoft Exchange Online Protection (EOP) offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools available to EOP admins.

 

Feature

Description

Where you can find it

For more information

Reports in the Office 365 admin center

The following mail protection reports in the Office 365 admin center provide an interactive reporting experience for EOP admins. These reports provide summary data and the ability to drill down into details about individual messages.

  • Protection   View information about spam and malware sent to and from your organization, and the total volume of mail sent to and from your organization.

  • Rules   View information about custom rules that affected mail sent to and from your organization.

In the Office 365 admin center, click Reports and then access the report you want to view.

For information about a specific report, open the report and hover over the information link next to the report title.

For more detailed information about the Reports page in the Office 365 admin center, see Use mail protection reports in Office 365 to view data about malware, spam, and rule detections..

Mail protection reports using the Excel reporting workbook

The email protection reports in the Excel 2013 reporting workbook are also available and provide summary reports with drill-down capabilities. However, we recommend using the enhanced Office 365 admin center reports instead. The Excel 2013 reporting workbook is planned to be deprecated in the future.

After it is installed, the workbook can be accessed directly using Excel 2013.

For more overview information and links to download and install the workbook, see Mail Protection Reports for Office 365.

For information about how to use the workbook, see Mail protection reports using the Excel reporting workbook.

Message tracing

Follows email messages as they travel through EOP. You can determine if an email message was received, rejected, deferred, or delivered by the service. It also shows what actions have occurred to the message before reaching its final status. Obtaining detailed information about a specific message lets you efficiently answer your user’s questions, troubleshoot mail flow issues, validate policy changes, and alleviates the need to contact technical support for assistance.

In the Exchange admin center (EAC), go to Mail flow > Message trace.

Trace an Email Message

Audit logging

Tracks specific changes made by admins to your organization. These reports can help you troubleshoot configuration issues or find the cause of security or compliance-related problems.

In the EAC, go to Compliance management > Auditing.

Auditing reports in EOP

The following table describes when EOP reporting and message trace data is available and for how long.

 

Report type

Data available for (look back period)

Latency

Office 365 mail protection summary reports

90 days

Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.

Office 365 mail protection detail reports

90 days

For detail data that’s less than 7 days old, data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.

To view detail reports for messages that are greater than 7 days old, results may take up to a few hours.

Excel 2013 workbook summary report

180 days

Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.

Excel 2013 workbook detail data

7 days

Data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.

Message trace data

90 days

When you run a message trace for messages that are less than 7 days old, the messages should appear within 5-30 minutes.

When you run a message trace for messages that are greater than 7 days old, results may take up to a few hours.

NoteNote:
Data availability and latency is the same whether requested via the UI (Office 365 admin center or the Excel 2013 workbook) or remote PowerShell.
 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft