Microsoft Brings the Top Senders and Recipients Report Back from the Dead

Antiquated Report Revived Because of Customer Feedback (But Better Alternatives Exist)

Microsoft published an update to message center notification MC237975 on April 22 to cancel the proposed retirement of the Top Senders and Recipients report and its associated PowerShell cmdlet (Get-MailTrafficSummaryReport) previously advised on February 5. According to the update, Microsoft based its decision on customer feedback, which means that some customers must like the report and the cmdlet. I am mystified why this is so. It’s a simply horrible report. In their defense, those advocating its retention must not understand that better alternatives exist.

Reports in the Office 365 Security and Compliance Center

The Top Senders and Recipients report is part of the Reports dashboard in the Office 365 Security and Compliance Center (SCC). Microsoft is doing its best to transfer functionality from the SCC to the Microsoft 365 admin center and announced on April 15 that they will soon start to automatically redirect usage away from the SCC. The reports section of the SCC is organized into a series of widgets, each representing a report. The Top Senders and Recipients report can look back 90 days (the period for which Exchange Online preserves message trace data) and the data it presents is moderately interesting, despite the horrible graphics (Figure 1).

The Top Senders and Recipients report in the SCC
Figure 1: The Top Senders and Recipients report in the SCC

The report and its underlying cmdlet are old (the cmdlet dates to at least 2015) and Microsoft has given them little or no tender loving care since. The data presented in the reports include all sorts of crud, such as message sent to replicate public folders between public folder mailboxes, updates sent by SharePoint Online when users share documents, and so on. You can’t apply a filter to remove all the system junk from the data, so you end up with useless statistics such as public folder replication represents 80.77% of all send message activity over the last 90 days.

Because it’s old and uncared for, the report doesn’t take account of recent advances such as plus addressing and the support in Exchange Online to allow users to send messages using any proxy address assigned to their mailbox. Each plus and proxy address is listed separately instead of being grouped under the mailbox.

It’s not as if it is difficult to filter out the system message overhead and create a report based on mailbox activity. Take the PowerShell example below, which uses the Get-MailTrafficSummaryReport cmdlet to create two arrays of sender and recipient data. After fetching the set of user mailboxes in the tenant, we loop through each mailbox to calculate the total number of messages sent and received.

[array]$SenderData = Get-MailTrafficSummaryReport -Category TopMailSender -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 
[array]$RecipientData = Get-MailTrafficSummaryReport -Category TopMailRecipient -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 
$MbxReport = [System.Collections.Generic.List[Object]]::new()

$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited
ForEach ($M in $Mbx) {
Write-Host "Processing" $M.DisplayName   
# Check each email proxy address to see if it was used to send email
[int]$TotalSentMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
      If ($A.Substring(0,4) -eq "smtp") {
         $Messages = $SenderData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
         # Write-Host "Messages found for" $A " " $Messages
         $TotalSentMessages = ($TotalSentMessages + $Messages) }
}
# Check each email proxy address to see if it was used to receive email
[int]$TotalReceivedMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
      If ($A.Substring(0,4) -eq "smtp") {
         $Messages = $RecipientData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
         Write-Host "Messages found for" $A " " $Messages
         $TotalReceivedMessages = ($TotalReceivedMessages + $Messages) }
}
     $ReportLine = [PSCustomObject] @{
        User                = $M.DisplayName
        Address             = $M.UserPrincipalName
        "Sent messages"     = $TotalSentMessages
        "Received messages" = $TotalReceivedMessages }    
      $MbxReport.Add($ReportLine) 
}
$MbxReport | Out-GridView

Figure 2 shows the output from the script. You can download a copy of the script from the Office 365 for IT Pros GitHub repository,

Output from the script based on data generated by the Get-MessageTrafficSummaryReport cmdlet
Figure 2: Output from the script based on data generated by the Get-MessageTrafficSummaryReport cmdlet

The Modern Usage Reporting Option

I imagine that the customers who protested the removal of the Top Senders and Recipients report did so because they use the report. Well, a better mousetrap exists for reports about user activity: the Microsoft Graph Reports API. The most important reason why is that the Graph API is the focus for future Microsoft development. The old Office 365 data warehouse, used as the basis for the older Exchange-based usage cmdlets, will eventually disappear.

The Exchange usage report in the Microsoft 365 admin center (Figure 3) is the closest to the Top Senders and Recipients report. It’s not perfect (what do “receive actions” really mean in terms of the number of messages received by a mailbox?), but it’s a good start. The data doesn’t line up exactly with what’s reported in the SCC. Usually, the Graph-based data for messages sent and received is under that reported by the SCC, but I’m willing to put that down to inconsistencies in the Office 365 data warehouse. In any case, tracking data about user activities is like using a personal step counter. The data might vary from device to device depending on how a device accounts for factors like stride length, but once you use the same device on a consistent basis, you have something to compare progress against.

The Exchange Online usage report in the Microsoft 365 admin center
Figure 3: The Exchange Online usage report in the Microsoft 365 admin center

The usage reports in the Microsoft 365 admin center use the Graph API and support features like the deidentification of personal user information. They also support going back 180 days instead of 90 days, and because the reports use a fully supported API, you can write your own code to generate the type of usage reports you want. An example of this is the per-user activity report spanning multiple Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams, and Yammer) written using a combination of PowerShell and Graph API calls.

Time to Switch from the Old Reports

If you’re one of the customers discommoded by Microsoft’s plan to retire the Top Senders and Recipients report, it’s time for you to consider looking at the replacements which already exist within Microsoft 365. The reports available in the admin center might be different, but the usage data is there. And if you don’t like what you see, consider investing some time to develop familiarity with the Microsoft Graph Reports API, maybe using PowerShell. The Graph is the future; the old reports will eventually disappear. Why stay fixed in the past when the future beckons?


We offer insights like this throughout the 24 chapters of the Office 365 for IT Pros eBook. It’s one of the reasons why our subscribers stay on top of new developments inside Office 365.

One Reply to “Microsoft Brings the Top Senders and Recipients Report Back from the Dead”

  1. Seriously? better alternatives? powershell? How about Microsoft actually retains one of the few useful tools in O365 for administrators

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.