Monitoring, reporting, and message tracing in Exchange Online

Exchange Online offers many different reports that can help you determine the overall status and health of your organization. There are also tools to help you troubleshoot specific events (such as a message not arriving to its intended recipients), and auditing reports to aid with compliance requirements. The following table describes the reports and troubleshooting tools that are available to Exchange Online administrators.

Feature Reports Location
Reports in the Microsoft 365 admin center Email activity

Email app usage

Mailbox usage

Microsoft 365 Groups activity

In the Microsoft 365 admin center, go to Show all (if necessary), click Reports > Usage, and then select one of the reports on the page:
  • Email activity
  • Active users - Microsoft 365 services > View more:
    • Exchange:
      • Email activity
      • Email app usage
      • Mailbox usage
    • Office 365:
      • Groups activity
Reports in the Microsoft Purview compliance portal DLP reports1 In the Microsoft Purview compliance portal (https://security.microsoft.com), go to Reports, and then select one of the available reports on the page. To go directly to the Reports page, use https://compliance.microsoft.com/reports.
Reports in the Microsoft Defender portal View Defender for Office 365 reports2

View email security reports

In the Microsoft Defender portal (https://security.microsoft.com), go to Reports > Email & collaboration > Email & collaboration reports, and then select one of the available reports on the page. To go directly to the Reports page, use https://security.microsoft.com/emailandcollabreport.
Reports using Microsoft Graph Programmatically create the reports that are available in the Microsoft 365 admin center by using Microsoft Graph. For more information, see the following topics:

Email activity reports

Email app usage reports

Mailbox usage reports

Microsoft 365 groups activity reports

n/a
Reports using reporting web services Programmatically create reports from the available Exchange Online PowerShell reporting cmdlets by using REST/ODATA2 query filtering.3

For more information, see Reporting Web Services.

https://reports.office365.com/ecp/reportingwebservice/reporting.svc
Message trace Message trace in the modern Exchange admin center In the Exchange admin center (https://admin.exchange.microsoft.com), go to Mail flow > Message trace.

Note: The Exchange message trace link in the Microsoft Defender portal opens message trace in the modern EAC.

Audit logging Search the audit log in the Microsoft Purview compliance portal) In the Microsoft Purview compliance portal (https://compliance.microsoft.com), go to Solutions > Audit > Search tab on the Audit page.

1 DLP is only available in certain Exchange Online subscription plans. For information, see the Data Loss Prevention entries in the Exchange Online Service Description.

2 Defender for Office 365 is available in Office 365 Enterprise E5, but you can also purchase Defender for Office 365 as an add-on to other subscription plans. For more information, see the Microsoft Defender for Office 365 Service Description.

3 Many of the original reporting cmdlets in Exchange Online PowerShell have been deprecated (the cmdlets are available, but they don't return useful data). For a list of available and unavailable reporting cmdlets, see Exchange reporting cmdlets.

Reporting and message trace data availability and latency

The following table describes when Exchange Online reporting and message trace data is available and for how long.

Report type Data available for (look back period) Latency
Mailbox summary reports 60 days Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.
Mail protection summary reports 90 days Message data aggregation is mostly complete within 24-48 hours. Some minor incremental aggregated changes may occur for up to 5 days.
Mail protection detail reports 90 days For detail data that's less than 7 days old, data should appear within 24 hours but may not be complete until 48 hours. Some minor incremental changes may occur for up to 5 days.

To view detail reports for messages that are greater than 7 days old, results may take up to a few hours.

Message trace data 90 days When you run a message trace for messages that are less than 7 days old, the messages should appear within 5-30 minutes.

When you run a message trace for messages that are greater than 7 days old, results may take up to a few hours.

Note

Data availability and latency doesn't depend on the user interface (it's the same in the admin centers as in PowerShell).