Microsoft Brings the Top Senders and Recipients Report Back from the Dead

Antiquated Report Revived Because of Customer Feedback (But Better Alternatives Exist)

Updated April 2022 with details of the new location for the Top Senders report and Top Recipients report in the Microsoft 365 Defender portal

Microsoft published an update to message center notification MC237975 on April 22, 2021 to cancel the proposed retirement of the Top Senders report and the Top Recipients report and its associated PowerShell cmdlet (Get-MailTrafficSummaryReport) previously advised on February 5, 2021. According to the update, Microsoft based its decision on customer feedback, which means that some customers must like the report and the cmdlet. I am mystified why this is so. It’s a simply horrible report. In their defense, those advocating its retention must not understand that better alternatives exist.

Reports in the Microsoft 365 Defender Portal

Originally located in the Office 365 Security and Compliance Center (SCC), the Top Senders report and Top Recipients report are now found under Email & Collaboration in the Reports section of the Microsoft 365 Defender portal. The reports section is organized into a series of widgets, each representing a report. The Top Senders and Recipients report can look back 90 days (the period for which Exchange Online preserves message trace data) and the data it presents is moderately interesting (Figure 1).

The Top Senders report and Top Recipients report and the underlying cmdlet are old (the cmdlet dates to at least 2015) and Microsoft has given them little or no tender loving care since. The data presented in the reports in the old SCC including all sorts of crud, such as message sent to replicate public folders between public folder mailboxes, updates sent by SharePoint Online when users share documents, and so on. You can’t apply a filter to remove all the system junk from the data, so you end up with useless statistics such as public folder replication represents 80.77% of all send message activity over the last 90 days. Thankfully, Microsoft applies better filters to the reports available in the Microsoft 365 Defender portal.

However, the Top Senders and Top Recipients reports don’t take account of recent advances such as plus addressing and the support in Exchange Online to allow users to send messages using any proxy address assigned to their mailbox. Each plus and proxy address is listed separately instead of being grouped under the mailbox.

It’s not difficult to filter out messages like those for system, group, and shared mailboxes to create a report based on mailbox activity. Take the PowerShell example below, which uses the Get-MailTrafficSummaryReport cmdlet to create two arrays of sender and recipient data for the last 90 days. After fetching the set of user mailboxes in the tenant, we loop through each mailbox to calculate the total number of messages sent and received. Because we focus solely on messages sent and received by user mailboxes, this approach excludes any system-generated traffic.

$StartDate = (Get-Date).AddDays(-92); $EndDate = (Get-Date).AddDays(+1)
[array]$SenderData = Get-MailTrafficSummaryReport -Category TopMailSender -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 
[array]$RecipientData = Get-MailTrafficSummaryReport -Category TopMailRecipient -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 
$MbxReport = [System.Collections.Generic.List[Object]]::new()

[array]$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited
ForEach ($M in $Mbx) {
Write-Host "Processing" $M.DisplayName   
# Check each email proxy address to see if it was used to send email
[int]$TotalSentMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
      If ($A.Substring(0,4) -eq "smtp") {
         $Messages = $SenderData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
         # Write-Host "Messages found for" $A " " $Messages
         $TotalSentMessages = ($TotalSentMessages + $Messages) }
}
# Check each email proxy address to see if it was used to receive email
[int]$TotalReceivedMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
      If ($A.Substring(0,4) -eq "smtp") {
         $Messages = $RecipientData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
         Write-Host "Messages found for" $A " " $Messages
         $TotalReceivedMessages = ($TotalReceivedMessages + $Messages) }
}
     $ReportLine = [PSCustomObject] @{
        User                = $M.DisplayName
        Address             = $M.UserPrincipalName
        "Sent messages"     = $TotalSentMessages
        "Received messages" = $TotalReceivedMessages }    
      $MbxReport.Add($ReportLine) 
}
$MbxReport | Out-GridView

Figure 2 shows the output from the script. You can download a copy of the script from the Office 365 for IT Pros GitHub repository.

The Modern Usage Reporting Option

I imagine that the customers who protested the removal of the Top Senders and Recipients report did so because they use the report. Well, a better mousetrap exists for reports about user activity: the Microsoft Graph Reports API. The most important reason why is that the Graph API is the focus for future Microsoft development. The old Office 365 data warehouse, used as the basis for the older Exchange-based usage cmdlets, will eventually disappear.

The Exchange usage report in the Microsoft 365 admin center (Figure 3) is the closest to the Top Senders and Recipients report. It’s not perfect (what do “receive actions” really mean in terms of the number of messages received by a mailbox?), but it’s a good start. The data doesn’t line up exactly with what’s reported in the Microsoft 365 Defender portal. Usually, the Graph-based data for messages sent and received comes in under the figures reported by the Microsoft 365 Defender portal, but I’m willing to put that down to inconsistencies in the Office 365 data warehouse. In any case, tracking data about user activities is like using a personal step counter. The data might vary from device to device depending on how a device accounts for factors like stride length, but once you use the same device on a consistent basis, you have something to compare progress against.

The usage reports in the Microsoft 365 admin center use the Graph API and support features like the deidentification of personal user information. They also support going back 180 days instead of 90 days, and because the reports use a fully supported API, you can write your own code to generate the type of usage reports you want. An example of this is the per-user activity report spanning multiple Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams, and Yammer) written using a combination of PowerShell and Graph API calls.

Time to Switch from the Old Reports

If you’re one of the customers discommoded by Microsoft’s plan to retire the Top Senders and Recipients report, it’s time for you to consider looking at the replacements which already exist within Microsoft 365. The reports available in the admin center might be different, but the usage data is there. And if you don’t like what you see, consider investing some time to develop familiarity with the Microsoft Graph Reports API, maybe using PowerShell. The Graph is the future; the old reports will eventually disappear. Why stay fixed in the past when the future beckons?

---

We offer insights like this throughout the 24 chapters of the Office 365 for IT Pros eBook. It’s one of the reasons why our subscribers stay on top of new developments inside Office 365.