Exchange Online Exposes New Mailbox Activity Data

Reporting Busy Exchange Online Mailboxes

It’s common for Exchange administrators to generate reports about user activity. In the past, people depended on the LastLogonTime property returned by the Get-MailboxStatistics cmdlet to know the last time a mailbox’s owner logged on. However, as I pointed out last year, the values returned by the cmdlet are usually misleading because of the number of background assistants that access mailboxes for different purposes.

New Assistant, New Mailbox Data

Although it doesn’t make LastLogonTime any more accurate, A new background assistant is designed to give more information about user behavior within mailboxes. The assistant examines signals generated by user activity to figure out the last time a mailbox owner performed actions in different categories. The information is not updated in real time and can be up to three days old. Even so, the new information gives extra insight into mailbox activity. Table 1 lists the last user activity properties. One interesting omission is that delete actions are not included in the calculation of last activity in any category.

Property Meaning
LastLogonTime Last time a process signed onto the mailbox. [Warning: background assistants often influence this data]
LastEmailTime Last time an email was sent from the mailbox or marked as read in the mailbox.
LastInteractionTime Last time the mailbox owner performed an action in the mailbox.
LastContactsTime Last time a contact was added, updated, or viewed.
LastCalendarTime Last time a calendar entry was added, updated, or a calendar invite was accepted/declined, or the user viewed the calendar.
LastTasksTime Last time a task was added, updated, or removed.
LastFileTime Last time the user accessed, modified, downloaded, renamed, or deleted a file in a SharePoint Online or OneDrive for Business document library.
LastProfileTime Last time the user’s profile was updated (for example, adding a photo).
LastUserActionWorkloadAggregateTime Last time for a recorded action across all workloads.
LastUserActionUpdateTime Last time the assistant processed the mailbox to calculate times from signals stored in the mailbox. The data might lag real-time information by up to 3 days.
LastModernGroupsTime Only generated for Office 365 Group mailboxes.

Table 1: Properties recording user activities in Exchange Online mailboxes

Accessing Activity Data with PowerShell

In May 2019, you could access the properties using PowerShell in two ways. First, you can run the Get-MailboxStatistics cmdlet, which has been updated to support the new information. For example, here’s how to retrieve last activity information for a mailbox:

Alternatively, you can access the properties from the diagnostic data generated by the Export-MailboxDiagnosticLogs cmdlet. Here’s how:

You can see that different property names are used and that the dates are reported in UTC instead of local time. LastinteractionTime is missing from the list of properties, but the others are available.

Summer Woes

And then the summer happened and the Exchange developers were sunburned. Or something else happened and they removed the activity reporting properties from Get-MailboxStatistics in July. And despite many protests, Microsoft has persisted with their view that Get-MailboxStatistics shouldn’t display these properties. Apart that is for LastInteractionTime and LastUserActionTime, both of which

Rather bizarrely, the properties are still available through the Export-MailboxDiagnosticLogs cmdlet. I guess I should be happy that the data is still available, but I have no idea why it was removed from Get-MailboxStatistics.

Generating a Mailbox Activity Report

Now that we understand how to access the last activity properties, we can generate reports. Here’s a simple script to grab the data for all user mailboxes, including some information about the size of each mailbox together with the number of items. I’ve also included LastLogon because it’s available in the full understanding that the data is likely incorrect for some mailboxes. After generating the report data, it’s exported to a CSV file.

Once it’s generated, the CSV file can be opened in Excel (Figure 1) or imported into another tool like Power BI for analysis.

Figure 1: A User Activity Report Generated using the new properties (image credit: Tony Redmond)

You can grab a copy of a script to retrieve this data from GitHub.

Insights are Valuable

In the “old days” mailbox activity reports were a valuable way of assessing if an account was used. This became more important when Office 365 arrived because underused accounts consumed monthly license fees. It’s still important to keep an eye on licenses, but the usage of an account is now split across many more workloads than just email. The fact that someone is not sending much email might be easily explained if they use Teams for internal communications and only ever send email when they need to contact an external person.

In any case, insights are valuable and it’s good to have this data available (even if some twists are needed to get it). The only problem now is to figure out what to do with it.


Don't have a login but want to join the conversation? Sign up for a Petri Account

Tony Redmond has written thousands of articles about Microsoft technology since 1996. He covers Office 365 and associated technologies for and is also the lead author for the Office 365 for IT Pros eBook, updated monthly to keep pace with change in the cloud.