Service Life CycleScenarioEXOLYOSPOOffice365 (suite wide) BuyProvisioning Licenses Storage ConsumeDevice – Software Device – Connections User

Mitch HallSenior Program ManagerMicrosoft – Office 365

Julie XuPrincipal Group Program ManagerMicrosoft – Office 365

Reporting in Office365

MNG304

AgendaOffice 365 report overviewMailbox, Mail flow and Protection reports

Mailbox, (Distribution) Groups, Protection, Data Loss Prevention, Transport Rules, Message Trace

Non mail related reportsLync, SharePoint, Auditing

How does it work?Other ways to retrieve your data

Remote PowerShellCustom Excel reportingDirect WSAPI programming

What's new?New reports, Interactive summary reports, with drill through detail reports

O365 ReportsOverview

Win Your Trust and ConfidenceConsistent and Complete

In the Know -- provisioning, usage & productivity, security, protection

Dynamic and Rich VisualizationData is easy to understandInteraction is intuitive

Actionable InsightHigh data quality and reliabilityAlways freshEnable and encourage action

Access to Your Data

Manage Your Cloud InvestmentService Life Cycle

Scenario EXO LYO SPO Office365(suite wide)

Buy Provisioning ü üLicenses

Storage ü ü

Consume Device – Software ü

Device – Connections ü

User - Email activity ü

User - Docs activity ü

User - Meetings activity ü

User - External Sharing ü

Exchange Online ServicesMail Activity Reports

Portal DefinitionNumber of active and inactive mailboxes over time. A mailbox is considered inactive if a user has not logged in for more than 30 days. Number of inactive mailboxes are grouped by the number of days the user has not logged in

Technical Definition – Active MailboxMailbox is connected Mailbox has been logged into in past 30 days (from store)OR Mailbox has been created in past 30 days (from AD)

Technical Definition – InActive MailboxMailbox is connected Mailbox has not been logged into in past 30 days (from store)Mailbox was created more than 30 days ago (from AD)

Mailbox Level DetailsVia Reporting Web Service and CMDLets

Web Service/ODATA APIStaleMailboxStaleMailboxDetail

CMDLetsGet-StaleMailboxReportGet-StaleMailboxDetailReport

Note!Inactive Mailbox here does not refer to the “inactive” mailbox state as defined by ligation hold. Yes, we know this is very confusing.

Inactive (a.k.a. Stale) Mailbox Report

Portal DefinitionShows the number of total number of mailboxes, inactive mailboxes, mailboxes exceeding their storage quota, and mailboxes using less than 25% of their storage limit.

Technical Definition – Total MailboxSource (AD)All connected Mailboxes

Technical Definition – InActive MailboxMailbox is connected Mailbox has not been logged into in past 30 days (from store)Mailbox was created more than 30 days ago (from AD)

Technical Definition – Exceeds Storage LimitSource AD (MBX limits)Source Store (MBX size)Over limit if MBX total item size is over IssueWarningQuota

Technical Definition – < 25% storageSource AD (MBX limits)Source Store (MBX size)< 25% of ProhibitSendReceiveQuota


Web Service/ODATA APIMailboxUsageMailboxUsageDetail

CMDLetsGet-MailboxUsageReportGet-MailboxUsageDetailReport

Mailbox Usage Report

Portal DefinitionShows the number of mailbox connections made over time, grouped by connection types.

Technical Definition – ProtocolsMAPI, OWA, EAS, EWS, IMAP, POP3

Technical Definition – Protocol CountCafé (CAS) logs for each protocol Distinct MBX accessed per dayAggregated daily


Web Service/ODATA APIConnectionByClientType (daily, weekly, monthly, yearly)ConnectionbyClientTypeDetail

CMDLetsGet-ConnectionByClientTypeReportGet-ConnectionByClientTypeDetailReport

Types of Mailbox Connections

Portal DefinitionShows the number of active mailboxes, and the number of mailboxes created and deleted. A mailbox is considered active if a user has accessed it at least once in the last 30 days.

Technical Definition – Total Active MailboxMailbox is connected Mailbox has been logged into in past 30 days (from store)OR Mailbox has been created in past 30 days (from AD)

Technical Definition –Mailbox CreatedSource (AD)Mailbox was created or reconnected in a dayDoes not count inter-day soft-deletes/restoresAggregated daily

Technical Definition –Mailbox DeletedSource (AD)Mailbox was soft deleted or removed in a dayDoes not count inter-day soft-deletes/restoresAggregated daily

Mailbox Level Details – Not AvailableSummary Via Reporting Web Service and CMDLets

Web Service/ODATA APIMailBoxActivity (daily, weekly, monthly, yearly)

CMDLetsGet-MailboxActivityReport

New and Deleted Mailboxes

Portal DefinitionShows the number of groups created and deleted.

Technical Definition – Group CreatedSource (AD)Groups created daily (WhenCreated==Today)Does not currently include DDGs (planned)Aggregated daily.

Technical Definition –Mailbox DeletedSource (AD)Groups deleted daily (WhenDeleted==Today)Does not currently include DDGs (planned)Aggregated Daily.

Group Level Details – Not AvailableSummary Via Reporting Web Service and CMDLets

Web Service/ODATA APIGroupActivity (daily, weekly, monthly, yearly)

CMDLetsGet-GroupActivityReport

New and Deleted Groups

Exchange Online ServicesMail Protection Reports

Portal DefinitionShows received mail based on traffic type

Technical DefinitionsGood Mail - messages that were received and not identified as spam or malwareSpam - messages identified as spam Malware - messages that contained malware Transport rules - messages that matched at least one rule DLP - messages that matched at least one DLP policy

Mail Level DetailsVia Reporting Web Service and CMDLets

Web Service/ODATA APIMailTraffic

CMDLetsGet-MailTraffic

EventTypesGoodMailMalwareTransportRuleHitsSpamEnvelopeBlockSpamIPBlockSpamContentFiltered

Sent/Received Mail Report

Portal DefinitionShows what spam was detected, grouped by spam filtering type.

Technical DefinitionsSMTP Blocked- Sender and recipient filteringIP Blocked -The reputation of the connecting IP address is evaluated by means of lists from partners and third-party providersContent filtered - content is checked for terminology or properties common to spam




EventTypesSpamEnvelopeBlockSpamIPBlockSpamContentFiltered

Spam Report

Portal DefinitionShows the number of malware detections in received mail, before the malware action was applied

Technical DefinitionsViruses infect other programs and data, and they spread throughout your computer looking for programs to infect.

Spyware refers to malware that gathers your personal information, such as sign-in information and personal data, and sends it back to its author.




EventTypeMalware

Malware Report

Portal DefinitionShows the number of transport rule matches in received mail, grouped by severity.

Technical DefinitionsSeverity is defined by the admin for each transport rule created




EventTypeTransportRuleHits

Transport Rule Report

Portal DefinitionShows the number of transport rule matches in received mail, grouped by severity.




EventTypeDLPPolicyHitsDLPPolicyOverrideDLPPolicyFalsePositive

Data Loss Prevention Summary Report Technical Definitions

Policy Matches: daily count of DLP policies that were matched.Overrides: daily count of the DLP Policies that were overridden by the user.False Positive: Daily count of DLP Policies that were reported as False Positive

Portal DefinitionShows the number of DLP rule matches in received mail, grouped by severity.

Technical DefinitionsSeverity is defined by the admin for each transport rule created




EventTypeDLPPolicyRuleHits

Data Loss Prevention Rule Report

Non Mail Reports

SharePoint reportsOneDrive for Business sites

Shows the number of active and inactive OneDrive for Business sites

OneDrive for Business storage Shows used vs. allocated storage space for OneDrive for Business sites

Team sites deployedShows the number of active and inactive team sites

Team site storage Shows used vs. allocated storage space for team sites

Tenant storage metrics Shows used, allocated, and total storage space for the entire tenant

Lync reportsActive and inactive users/audio sessions

Shows the total number of unique users who signed in and took part in a peer-to-peer session or conference.

Audio/video conference minutesShows the total number of minutes users spent in audio\/video conferences over time.

Application sharingShows the number of application sharing, web, and dial-in conferences over time.

How Does it Work

How does it work

Exchange

EOP

SPO

LYO

Email

Mail Traffic

ReportingDatamarts

Report Data

ReportData

ReportData

ReportData

ReportingWebService

(odata)

O365Report Console

PowerShell

O365Console

WSAPI

RemotePowerShell

Mail Traffic

Access data via O365

Exchange

EOP

SPO

LYO

Email

Mail Traffic

ReportingDatamarts

Report Data

ReportData

ReportData

ReportData

ReportingWebService

(odata)

O365Report Console

PowerShell

O365Console

WSAPI

RemotePowerShell

Mail Traffic

Office 365 reportsDemo

O365 Remote PowerShell

Access data via PowerShell

Exchange

EOP

SPO

LYO

Email

Mail Traffic

ReportingDatamarts

Report Data

ReportData

ReportData

ReportData

ReportingWebService

(odata)

O365Report Console

PowerShell

O365Console

WSAPI

RemotePowerShell

Mail Traffic

Remote PowerShellDemo

Web Service API

Access data via WSAPI

Exchange

EOP

SPO

LYO

Email

Mail Traffic

ReportingDatamarts

Report Data

ReportData

ReportData

ReportData

ReportingWebService

(odata)

O365Report Console

PowerShell

O365Console

WSAPI

RemotePowerShell

Mail Traffic

Access to data via Excel

All reporting endpoints are public facing odata feed

Excel 2013 has the ability to pull Odata feeds and interact with the data

Excel ReportDemo

Custom ApplicationDemo

O365 ReportingEnhancements

What's new – Spring 2014Client side rendering

Allows for greater interactivity with the data. Provides ability to slice data to see spikes or trends

Access to detail recordsTo analyze a trend or spike, you can click through to associated detail data.

Access to historical dataFor data that’s a bit older, you can submit a request to provide the data via download.

Browser/OS report

Browser/OS ReportDemo

Enhanced ReportingDemo

O365 Future Reports

Future reportsExchange ActiveSync Device Reports

Mobile PlatformShows historical trends of devices broken down by mobile OS families. This report will allow a drill down on OS versions and device models.

Device Activity: Shows historical trends of what devices have been blocked due to compliancy or were quarantined

OneDrive for Business ReportsFiles and Folders Activity LogsShows who did what and when to a file and folder stored in OneDrive for Business. This report will answer the following question: what happened to my file?

User Storage and Quota: Shows at the user level, allocated and used storage quota

Future auditing reportsAzure Active Directory logs

This report will contain the following items: User, Group, Device, and Licensing CRUD, Change auth or password policies, Change Company/Partner/DirSync Info

SharePoint tenant admin plus site collection admin logsThis report will contain SharePoint Tenant admin and Site Collection admin logs

SharePoint Site user logsThis report will contain SharePoint site user usage logs

OneDrive for Business tenant admin/user logsThis report will contain OneDrive for Business tenant admin logs

OneDrive for Business user logsThis report will contain OneDrive for Business user logs

DC Admin activity logs across Exchange, SharePoint and OneDrive for Business

Today we only provide DC admin logs for Exchange. This report will provide DC admin logs across Exchange, SharePoint and OneDrive for Business

TakeawaysConfidence

Confidence that when you move to the Office 365 service you still have total control of your user experience.

InsightsOffice 365 services offer you valuable insights to assure your that your investment provides a valuable return.

ActionEasy access to data, ability to analyze data quickly allows you to take timely action.

Ongoing improvementsMicrosoft will continue to invest in additional reports and capabilities that will provide greater access and flexibility to access your data

Multiple ways to access your dataO365 admin console, PowerShell, WSAPI(Excel, custom app)

Useful links

Reportshttp://technet.microsoft.com/en-us/library/office-365-reports.aspx

Remote PowerShellhttp://technet.microsoft.com/en-us/library/

jj984289(v=exchg.150).aspxhttp://technet.microsoft.com/en-us/library/

dn621039(v=exchg.150).aspx

MSDN docs for WASPIhttp://msdn.microsoft.com/en-us/library/office/jj984321.aspx

Similar Sessions to Attend Session Title Timing Room

SPR.202 Encryption in ExchangeTue 10:45 AM - 12:00 PM Ballroom E

SPR.201

Eliminate the Regulatory Compliance Nightmare

Tue 9:00 AM-10:15 AM MR 19ab

SPR.UN.305

Exchange Online Protection: Notes from the field

Wed 10:15 AM – 11:30 AM Ballroom G

SPR.UN.304Experts Unplugged: EOP & Encryption

Wed 8:30-9:45 AMWed 1:00-2:15 PM

MR 18dMR 17b

SPR.401

Extending Data Loss Prevention For Your Business

Wed 4:45 PM- 6:00 PM MR 18bc

SPR.203

Protect your Organization with Exchange Online Protection (EOP)

Mon 4:30 PM - 5:45 PM MR 18bc

SPR.301So how does Microsoft handle my spam?

Tue 4:45 PM – 6:00 PM MR 19ab

SPR.401Using Connectors & Mail Routing

Wed 2:45 PM - 4:00 PM MR 18bc

Similar Sessions to Attend Session Title Timing Room

SPR.202 Encryption in ExchangeTue 10:45 AM - 12:00 PM Ballroom E

ARC.304Exchange Server 2013 Transport Architecture Tues 9:00 AM - 10:15 AMBallroom F

EDC.302Advanced Data Loss Prevention in Exchange Tues 1:30 PM-2:45 PM Ballroom F

EDC.UN.301Experts Unplugged: Data Loss Prevention

Tue 3:00 PM-4:15 PMWed 10:15 AM-11:30 AM

MR 18dMR 13ab

EDC.204Data Loss Prevention in Exchange, Outlook, OWA Mon 2:45 Pm-4:00PM MR 18bc

MNG.304Reporting On O365 Mail flow and Mailbox Data Wed 1:00 PM-2:15 PM MR 17a

MNG.301Exchange Admin Center - getting administration done

Wed 10:15 AM - 11:30 AM MR 18bc

© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Documents

Service Life CycleScenarioEXOLYOSPOOffice365 (suite wide) BuyProvisioning Licenses Storage ConsumeDevice – Software Device – Connections User