Friday, January 19, 2018

A walk-though using the Graph API Mailbox reports in Powershell

Quite recently the Reporting side of the Graph API has moved in GA from beta, there are quite a number of reports that can be run across various Office365 surfaces but in this post I'm going to focus on the Mailbox related ones.

Accessing Office365 Reports using Powershell is nothing new and has been available in the previous reporting endpoint however from the end of January many of these cmdlets are now being depreciated in favour of the Graph API .


In comparison to using the Remote PowerShell cmdlets where only the correct Office365 Admin permissions where needed, to use the new Graph API reports endpoint you need to use OAuth for authentication so this requires an Application Registration  that is then given the correct oAuth Grants to use the Reports EndPoint. Only one particular grant is need for this eg

This is a big advantage over the previous Web Service along with the benefits of using Token based authentication and different App usage scenarios it limits access to just what is needed to read reports which help limit the security risks associated.

Accessing the Reporting Endpoint

To access and Run the reports you will need code that first Authenticates and generates an oAuth Token based on your App registration. My Exch-Rest module can be used for this (Connect-EXRMailbox will imitate the token Authentication) or there are other scripts people have posted that can also do this .

Inputs and Outputs

Compared to the  Remote PowerShell cmdlets the richness of Input parameters for the reports at GA is limited (even when compared to the beta which was more a little rich). For most of the Mailbox Reports the only input parameter is the Period best explained in the documentation
"Specifies the length of time over which the report is aggregated. The supported values for {period_value} are: D7, D30, D90, and D180. These values follow the format Dn where n represents the number of days over which the report is aggregated" ref
So if your trying to feature match your current scripts against the new Graph API you may need to look at restructuring or rethinking your process a little, at the end of the day the data is same but you may need to post process it more at the client side.

On the Output side a CSV is generated by the Graph API and returned to the user, currently because the endpoint doesn't yet support the Filter Query parameter if you want to perform any filtering you will need to do it post process once the CSV is downloaded. (I would expect that in future updates the other QueryStrings will be supported which will improve the flexibility for those working with very larger result sets in Larger tenants.

The Actual Reports 

Given the refresh time of the Graph API it mostly likely this list is already out of date by the time you read this. All the screenshots are from the reporting Cmdlets in lastest version of my Exch-Rest Module which you can get from the PowerShell gallery  to use the cmdlets you need to first authenticate using Connect-ExrMailbox with an app registration that has been granted the "Read Usage Report" permission.


This report returns mailbox usage information or in plane English how big your Mailbox is and what the Quotas are. eg

The Remote PowerShell cmdlet Get-MailboxUsageDetailReport returned the same information with a few extra fields but these fields are retrievable via other Graph endpoints

Eg MailboxPlan is returned via the users endpoint eg'')/assignedLicenses if needed etc. Other information that is missing like percentage used can be calculated from other values in the data provided.

(What's missing which was also absent in the Office 365 Reporting Web Service is the ability to report on the size of the Archive Mailbox. I hope this feature will appear in the future as its a critical data point to track for people using Archives).


This report gives you daily tracking numbers of Active Mailbox use in your org eg

This report returns information about the Mailbox size status to the quotas that are configured, you want to use this in conjunction with GetMailboxUsageDetails which will allow you to pinpoint the actual mailboxs this summary reports are referring to.

This report returns the aggregated storage usage across the tenant (?? does it include archives ??)

This report is one of the more useful report as it gives you Message activity of a particular user eg the following is the last 30 days of my usage

This is also one of the reports that takes a parameter other then the Period eg you can enter a particular date value for the date you want to report activity on. eg tracking over a period of time

This reports give you the Activity counts of you users doing particular activities (my tenant is kind of a lonely one)


This gives you details of the Client application use

This gives you summary information on App usages 

This gives summary information on Client App version usage

Wednesday, January 03, 2018

Major update to my Exch-Rest Powershell Module for accessing Office365 and Exchange 2016 Mailboxes via REST

For about a year I've being working on a PowerShell Module for accessing the new REST API for Office365 (the Graph API) and Exchange 2016. I've been experimenting and listening to the various feedback I've been getting and finally have an update to share that addresses a lot of the useability issues (okay it was just too developer orientated).

Application registrations

Still probably the biggest stumbling block is not having an application registration, I now have a menu that allows to you use various default registrations for testing and also to save a default registration that you create. This means once you have your own registration setup you can save the ClientId so it will be used as the default when you next use the module.


A failure in proper planning when I initially created the module meant I didn't use a specific alias for the cmdlets in the module which meant it can cause a lot of conflicts if you have other modules loaded. With the new version all cmldets have a -EXR moniker.

Token Caching

With previous versions of the module you basically would authenticate and create an access token and store that in a local variable which you then had to pass into each of the cmdlets using the -AccessToken parameter along with the MailboxName. This meant a lot of typing and really broke the useability flow without really providing any security benefits. With the new module while all these old behaviours are still valid there is now a Connect-EXRMailbox cmdlet which is the new entry point cmdlet which will store the token and the name of the mailbox associated with the Token in a script variable (encrypted of course) but accessible by the module. This means you can run most of the cmdlets without specifying a Mailbox or Access Token if you just want to return details about the current mailbox that has been authenticated. Also when it comes to using Directory or Reporting cmdlets it eliminates the need for MailboxName which used mandatory parameter on all cmdlets. 

New Getting Started Guide 

With this type of project documentation is the hardest thing as its the least interesting and more time consuming things to get correct. I've written a new getting Started Guide for people that haven't used the module before. The old readme guide is still valid so if your looking to use App Tokens this going to be useful

New Cmdlets

I have a lot of new cmldets most aren't documented in anyway but I hope to put these more into Context in the new year on the blog and on GitHub. Things like accessing the Reporting API's is interesting which I've covered briefly in the new Getting Started guide.

The new module Exch-Rest is available from the PowerShell Gallery here or the source code which will contains all the latest code is available on GitHub here.

 Feedback and Contributions

As always I welcome any feedback or contributors who want to improve the module