Antiquated Report Revived Because of Customer Feedback (But Better Alternatives Exist)
Updated April 2022 with details of the new location for the Top Senders report and Top Recipients report in the Microsoft 365 Defender portal
Microsoft published an update to message center notification MC237975 on April 22, 2021 to cancel the proposed retirement of the Top Senders report and the Top Recipients report and its associated PowerShell cmdlet (Get-MailTrafficSummaryReport) previously advised on February 5, 2021. According to the update, Microsoft based its decision on customer feedback, which means that some customers must like the report and the cmdlet. I am mystified why this is so. It’s a simply horrible report. In their defense, those advocating its retention must not understand that better alternatives exist.
Reports in the Microsoft 365 Defender Portal
Originally located in the Office 365 Security and Compliance Center (SCC), the Top Senders report and Top Recipients report are now found under Email & Collaboration in the Reports section of the Microsoft 365 Defender portal. The reports section is organized into a series of widgets, each representing a report. The Top Senders and Recipients report can look back 90 days (the period for which Exchange Online preserves message trace data) and the data it presents is moderately interesting (Figure 1).
Figure 1: The Top Senders and Recipients report in the Microsoft 365 Defender portal
The Top Senders report and Top Recipients report and the underlying cmdlet are old (the cmdlet dates to at least 2015) and Microsoft has given them little or no tender loving care since. The data presented in the reports in the old SCC including all sorts of crud, such as message sent to replicate public folders between public folder mailboxes, updates sent by SharePoint Online when users share documents, and so on. You can’t apply a filter to remove all the system junk from the data, so you end up with useless statistics such as public folder replication represents 80.77% of all send message activity over the last 90 days. Thankfully, Microsoft applies better filters to the reports available in the Microsoft 365 Defender portal.
However, the Top Senders and Top Recipients reports don’t take account of recent advances such as plus addressing and the support in Exchange Online to allow users to send messages using any proxy address assigned to their mailbox. Each plus and proxy address is listed separately instead of being grouped under the mailbox.
It’s not difficult to filter out messages like those for system, group, and shared mailboxes to create a report based on mailbox activity. Take the PowerShell example below, which uses the Get-MailTrafficSummaryReport cmdlet to create two arrays of sender and recipient data for the last 90 days. After fetching the set of user mailboxes in the tenant, we loop through each mailbox to calculate the total number of messages sent and received. Because we focus solely on messages sent and received by user mailboxes, this approach excludes any system-generated traffic.
$StartDate = (Get-Date).AddDays(-92); $EndDate = (Get-Date).AddDays(+1)
[array]$SenderData = Get-MailTrafficSummaryReport -Category TopMailSender -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2
[array]$RecipientData = Get-MailTrafficSummaryReport -Category TopMailRecipient -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2
$MbxReport = [System.Collections.Generic.List[Object]]::new()
[array]$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited
ForEach ($M in $Mbx) {
Write-Host "Processing" $M.DisplayName
# Check each email proxy address to see if it was used to send email
[int]$TotalSentMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
If ($A.Substring(0,4) -eq "smtp") {
$Messages = $SenderData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
# Write-Host "Messages found for" $A " " $Messages
$TotalSentMessages = ($TotalSentMessages + $Messages) }
}
# Check each email proxy address to see if it was used to receive email
[int]$TotalReceivedMessages = 0 ; [int]$Messages = 0
ForEach ($A in $M.EmailAddresses) {
If ($A.Substring(0,4) -eq "smtp") {
$Messages = $RecipientData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2
Write-Host "Messages found for" $A " " $Messages
$TotalReceivedMessages = ($TotalReceivedMessages + $Messages) }
}
$ReportLine = [PSCustomObject] @{
User = $M.DisplayName
Address = $M.UserPrincipalName
"Sent messages" = $TotalSentMessages
"Received messages" = $TotalReceivedMessages }
$MbxReport.Add($ReportLine)
}
$MbxReport | Out-GridView
Figure 2 shows the output from the script. You can download a copy of the script from the Office 365 for IT Pros GitHub repository.
Figure 2: Output from the script based on data generated by the Get-MessageTrafficSummaryReport cmdlet
The Modern Usage Reporting Option
I imagine that the customers who protested the removal of the Top Senders and Recipients report did so because they use the report. Well, a better mousetrap exists for reports about user activity: the Microsoft Graph Reports API. The most important reason why is that the Graph API is the focus for future Microsoft development. The old Office 365 data warehouse, used as the basis for the older Exchange-based usage cmdlets, will eventually disappear.
The Exchange usage report in the Microsoft 365 admin center (Figure 3) is the closest to the Top Senders and Recipients report. It’s not perfect (what do “receive actions” really mean in terms of the number of messages received by a mailbox?), but it’s a good start. The data doesn’t line up exactly with what’s reported in the Microsoft 365 Defender portal. Usually, the Graph-based data for messages sent and received comes in under the figures reported by the Microsoft 365 Defender portal, but I’m willing to put that down to inconsistencies in the Office 365 data warehouse. In any case, tracking data about user activities is like using a personal step counter. The data might vary from device to device depending on how a device accounts for factors like stride length, but once you use the same device on a consistent basis, you have something to compare progress against.
Figure 3: The Exchange Online usage report in the Microsoft 365 admin center
The usage reports in the Microsoft 365 admin center use the Graph API and support features like the deidentification of personal user information. They also support going back 180 days instead of 90 days, and because the reports use a fully supported API, you can write your own code to generate the type of usage reports you want. An example of this is the per-user activity report spanning multiple Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams, and Yammer) written using a combination of PowerShell and Graph API calls.
Time to Switch from the Old Reports
If you’re one of the customers discommoded by Microsoft’s plan to retire the Top Senders and Recipients report, it’s time for you to consider looking at the replacements which already exist within Microsoft 365. The reports available in the admin center might be different, but the usage data is there. And if you don’t like what you see, consider investing some time to develop familiarity with the Microsoft Graph Reports API, maybe using PowerShell. The Graph is the future; the old reports will eventually disappear. Why stay fixed in the past when the future beckons?
We offer insights like this throughout the 24 chapters of the Office 365 for IT Pros eBook. It’s one of the reasons why our subscribers stay on top of new developments inside Office 365.
I’m going to guess that the person who wrote this article is a developer with a lot of spare time on his hands, rather than a day-to-day system administrator. What administrators need is a quick at-a-glance graphical representation of particular types of activities, especially when management asks for a report ASAP.. Most of us do NOT have the free time to develop PowerShell scripts to customize the data extraction we often need at a moment’s notice. The writer’s condescending attitude is unwelcome, and this article is entirely unhelpful.
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
Seriously? better alternatives? powershell? How about Microsoft actually retains one of the few useful tools in O365 for administrators
I’m going to guess that the person who wrote this article is a developer with a lot of spare time on his hands, rather than a day-to-day system administrator. What administrators need is a quick at-a-glance graphical representation of particular types of activities, especially when management asks for a report ASAP.. Most of us do NOT have the free time to develop PowerShell scripts to customize the data extraction we often need at a moment’s notice. The writer’s condescending attitude is unwelcome, and this article is entirely unhelpful.