Mailbox analytics is something Microsoft have been working on for a number of years and its seems to be something that has received a little more effort in these pandemic times. If you have ever looked at the Non_IPM_Subtree of your mailbox you will see a lot of data being stored in their from various apps and substrate processes. A while back i wrote a ChangeDiscovery script to allow me to dump out quick what changes where happening in a Mailbox in a short time frame (eg i wanted to see what happened to all the items in a Mailbox when i performed a specific task). If you run this script with a slightly longer time-frame (eg looking over a day) it picks up all the Items that are being written and created for the Mailbox insights processes and other substrate processes.
Most of these emails get written under the
Usually if I then wanted to look at these type of items I would use OutlookSpy or MFCMapi to browse the raw MAPI properties on items to see if they where of interest. Given the number of these items now and the performance on MAPI in Online mode doing this is extremely tedious so I modified my change discovery script further to dump the RawJson and Data properties that most of the insight items use so you can then look at the whole bunch in Excel. eg the following two properties
So now i can dump basically everything that is happening in a Mailbox to a CSV in the last day and you can see some of this analytics data is pretty interesting
and if you looked at the data from the ActivitiesDaily
This is just a quick snippet of data on one item but things like the hourly breakdown of the number of the Messages being read per hour by a user is something that is really interesting and not something you can determine just using the raw data in a Mailbox.
While this raw data may surface elsewhere in a number of different guises and formats that are a lot of specific things you could use it for (outside of the narrative Microsoft are using for this).
The Modified change discovery script is available on Github https://github.com/gscales/Powershell-Scripts/blob/master/ChangeDiscovery.ps1
To run the script and look back 12 hours and dump the RawJson properties use something like
Invoke-MailboxChangeDiscovery -MailboxName email@example.com -disableImpersonation -getJsonMetaData -secondstolookback 43200
for 24 hours use
Invoke-MailboxChangeDiscovery -MailboxName firstname.lastname@example.org -disableImpersonation -getJsonMetaData -secondstolookback 86400