Exchange 365 Identify In-Use Email Addresses

[Bedders]

Afternoon all,

Does anyone know of a way to run a report for Exchange 365 (either GUI or PowerShell) to find out a list of every email address in the tenancy that has received an email in the last 30 days?

 

I'm not that hot with Microsoft 365 so apologies if my understanding is flawed.

[simpsonj]

I would:

 

Login to the O365 Admin Centre - Reports - Usage

Click Export and save the Excel Spreadsheet

Open the spreadsheet - Insert Pivot Table

Add Display Name to Row Labels

Add Received Count to Values

Add Last Activity Date to Filters

Filter the row labels with values above 1

Filter the Activity date, manually clicking each date (there may be a better way to do this!)

 

That should give you the info you're after

[simpsonj]

Also, before you export the spreadsheet, ensure the data is for the last 30 days (there's a drop down menu to the top right on the usage screen)

[Bedders]

Also, before you export the spreadsheet, ensure the data is for the last 30 days (there's a drop down menu to the top right on the usage screen)

 

Thanks for the help!

 

That looks close to what I'm after, but that is providing a list of mailboxes that have received mail. I'm looking specifically for the email addresses (including aliases) that have received mail.

What I'm after may not even be possible within O365.

[HPlum78]

When an email is sent to an aliases is it not resolved to the actual email address before being delivered, I thought it was, not in front of a computer but if you do a message trace on a mail that you send in to an aliases you can see the steps that are taken. Not absolutely sure, but it may mean that you don't need to consider reporting on mail in to aliases, if you see what I mean.

[Bedders]

Unfortunately I'm moving these users (there are only 7 of them) off O365 and onto our larger on-premise Exchange server, and I was hoping to identify any legacy email addresses that are still receiving mail that have been added as aliases to current staff. I suspect a number of suppliers only have old email addresses of people who've left but since O365 seems to work only by the final mailbox it makes it very difficult to determine which aliases are in use. I guess I'll just port them all over, and remove any after a couple of months.

Thanks for the help though!

[HPlum78]

Ah I see yeah that what I have said ain't any use then... Good luck.

[NicholasEsping]

In exchange admin center you can use message trace under mailflow to do this. You would put *@schooldomain.com for the recipient and choose a custom date range.

[Bedders]

In exchange admin center you can use message trace under mailflow to do this. You would put *@schooldomain.com for the recipient and choose a custom date range.

 

Ah, that might work it! I've scheduled a trace for the last 90 days and will see what happens after the weekend. I thought you had to choose a mailbox to run the trace against, I didn't realise it could be done across the whole domain.

Thanks

[ozydave]

You could install AdminDroid. You get a 14 day trial. Gives all sorts of info about your 365 environment