Petri Newsletter Sign-up
Tech Tuesday

Subscribe to Tech Tuesday, the latest insights from Petri.com for IT Pros.

    See All Petri Newsletters

    Exchange Online Exposes New Mailbox Activity Data

    Posted on by Tony Redmond in Exchange Online, Exchange Server, Office, and Office 365 with 1 Comment

    Reporting Busy Exchange Online Mailboxes

    It’s common for Exchange administrators to generate reports about user activity. In the past, people depended on the LastLogonTime property returned by the Get-MailboxStatistics cmdlet to know the last time a mailbox’s owner logged on. However, as I pointed out last year, the values returned by the cmdlet are usually misleading because of the number of background assistants that access mailboxes for different purposes.

    New Assistant, New Mailbox Data

    Although it doesn’t make LastLogon any more accurate, A new background assistant is designed to give more information about user behavior within mailboxes. The assistant examines signals generated by user activity to figure out the last time a mailbox owner performed actions in different categories. The information is not updated in real time and can be up to three days old. Even so, the new information gives extra insight into mailbox activity. Table 1 lists the last user activity properties. One interesting omission is that delete actions are not included in the calculation of last activity in any category.

    Property Meaning
    LastLogonTime Last time a process signed onto the mailbox. [Warning: background assistants often influence this data]
    LastEmailTime Last time an email was sent from the mailbox or marked as read in the mailbox.
    LastInteractionTime Last time the mailbox owner performed an action in the mailbox.
    LastContactsTime Last time a contact was added, updated, or viewed.
    LastCalendarTime Last time a calendar entry was added, updated, or a calendar invite was accepted/declined, or the user viewed the calendar.
    LastTasksTime Last time a task was added, updated, or removed.
    LastFileTime Last time the user accessed, modified, downloaded, renamed, or deleted a file in a SharePoint Online or OneDrive for Business document library.
    LastProfileTime Last time the user’s profile was updated (for example, adding a photo).
    LastUserActionWorkloadAggregateTime Last time for a recorded action across all workloads.
    LastUserActionUpdateTime Last time the assistant processed the mailbox to calculate times from signals stored in the mailbox. The data might lag real-time information by up to 3 days.
    LastModernGroupsTime Only generated for Office 365 Group mailboxes.

    Table 1: Properties recording user activities in Exchange Online mailboxes

    Accessing Activity Data with PowerShell

    In May 2019, you could access the properties using PowerShell in two ways. First, you can run the Get-MailboxStatistics cmdlet, which has been updated to support the new information. For example, here’s how to retrieve last activity information for a mailbox:


    Alternatively, you can access the properties from the diagnostic data generated by the Export-MailboxDiagnosticLogs cmdlet. Here’s how:


    You can see that different property names are used and that the dates are reported in UTC instead of local time. LastinteractionTime is missing from the list of properties, but the others are available.

    Summer Woes

    And then the summer happened and the Exchange developers were sunburned. Or something else happened and they removed the activity reporting properties from Get-MailboxStatistics in July. And despite many protests, Microsoft has persisted with their view that Get-MailboxStatistics shouldn’t display these properties. Apart that is for LastInteractionTime and LastUserActionTime, both of which

    Rather bizarrely, the properties are still available through the Export-MailboxDiagnosticLogs cmdlet. I guess I should be happy that the data is still available, but I have no idea why it was removed from Get-MailboxStatistics.

    Generating a Mailbox Activity Report

    Now that we understand how to access the last activity properties, we can generate reports. Here’s a simple script to grab the data for all user mailboxes, including some information about the size of each mailbox together with the number of items. I’ve also included LastLogon because it’s available in the full understanding that the data is likely incorrect for some mailboxes. After generating the report data, it’s exported to a CSV file.


    Once it’s generated, the CSV file can be opened in Excel (Figure 1) or imported into another tool like Power BI for analysis.

    Figure 1: A User Activity Report Generated using the new properties (image credit: Tony Redmond)

    Insights are Valuable

    In the “old days” mailbox activity reports were a valuable way of assessing if an account was used. This became more important when Office 365 arrived because underused accounts consumed monthly license fees. It’s still important to keep an eye on licenses, but the usage of an account is now split across many more workloads than just email. The fact that someone is not sending much email might be easily explained if they use Teams for internal communications and only ever send email when they need to contact an external person.

    In any case, insights are valuable and it’s good to have this data available (even if some twists are needed to get it). The only problem now is to figure out what to do with it.

    BECOME A PETRI MEMBER:

    Don't have a login but want to join the conversation? Sign up for a Petri Account

    Register

    Register for this Petri Webinar!

    Software-Defined Backup Storage: Agnostic, Easy and Cloud-Ready

    Tuesday, August 27, 2019 @ 1:00 pm EDT

    A Scale-Out Backup storage infrastructure is a must-have technology for your backups. In this webinar, join expert Rick Vanover for a look on what real-world problems are solved by the Scale-Out Backup Repository.

    Register Now

    Sponsored By