Get Exchange Online mail traffic report with PowerShell

Companies like to know how many emails they get an hour or a day. Perhaps they want to gather the total inbound mail and outbound mail for their analytics. With the Get-MailTrafficATPReport cmdlet in PowerShell, we can check the total inbound and outbound mail and a bunch more. Let’s find out more about how to get Exchange Online mail traffic report with PowerShell.

Connect to Exchange Online PowerShell

Run Windows PowerShell as administrator and connect to Exchange Online PowerShell.

PS C:\> Connect-ExchangeOnline

After connecting, let’s proceed to the next step.

Get mail traffic report

Run the Get-MailTrafficATPReport cmdlet. It will output the Exchange Online traffic summary and the last seven days will appear.

Note: The Get-MailTrafficATPReport cmdlet is only available for Exchange Online and not for Exchange on-premises.

PS C:\> Get-MailTrafficATPReport

Date                Event Type      Direction Verdict Source Message Count
----                ----------      --------- -------------- -------------
07/06/2023 00:00:00 General filter  Inbound   Phish          3            
06/06/2023 00:00:00 General filter  Inbound   Phish          2            
06/06/2023 00:00:00 General filter  Inbound   Spam           1            
06/06/2023 00:00:00 Message passed  Inbound   NotSpam        1            
05/06/2023 00:00:00 Advanced filter Inbound   Phish          1            
05/06/2023 00:00:00 Advanced filter Inbound   Spam           1            
03/06/2023 00:00:00 Advanced filter Inbound   Phish          3            
02/06/2023 00:00:00 Message passed  Inbound   NotSpam        16           
02/06/2023 00:00:00 Message passed  IntraOrg  Allow          25           
02/06/2023 00:00:00 Message passed  IntraOrg  NotSpam        4            
02/06/2023 00:00:00 Message passed  Outbound  NotSpam        9        

Let’s go a little more in detail and get a separate mail report for inbound and outbound.

Get mail traffic report inbound

Filter report by day

Filter on inbound mail by day.

In this example, we did select June 2, 2023.

PS C:\> Get-MailTrafficATPReport -Direction "Inbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 00:00:00 Message passed Inbound   NotSpam        16           

Filter report by good mail

Filter mail traffic report by the event type Message passed.

The Message passed messages are delivered after passing through the malware and spam filters. This count shows the number of unique messages. If a message were delivered to multiple recipients, it would still count as a single message.

PS C:\> Get-MailTrafficATPReport -Direction "Inbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00" -EventType "Message Passed"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 00:00:00 Message passed Inbound   NotSpam        16           

Filter report aggregate by hour

Add the AggregateBy parameter with the value Hour.

The AggregateBy parameter specifies the reporting period. Valid values are Hour, Day, or Summary. The default value is Day.

PS C:\> Get-MailTrafficATPReport -Direction "Inbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00" -EventType "Message Passed" -AggregateBy "Hour"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 09:00:00 Message passed Inbound   NotSpam        2            
02/06/2023 10:00:00 Message passed Inbound   NotSpam        12           
02/06/2023 21:00:00 Message passed Inbound   NotSpam        2            

Filter report by month

Do you want to check how much good inbound mail the last month was? Let’s get the good mail of the last month, May 2023, which is 31 days.

PS C:\> Get-MailTrafficATPReport -Direction "Inbound" -StartDate "05/01/2023 00:00" -EndDate "05/31/2023 00:00" -EventType "Message Passed"

Get total inbound messages by month

Let’s see how many messages the good mail inbound was for May 2023.

Add the Measure-Object cmdlet to calculate the Average, Sum, Maximum, and Minimum numeric values. We can see that the total inbound for May 2023 was 77539 messages.

PS C:\> Get-MailTrafficATPReport -Direction "Inbound" -StartDate "05/01/2023 00:00" -EndDate "05/31/2023 00:00" -EventType "Message Passed" -AggregateBy Day | Measure-Object "MessageCount" -Average -Sum -Maximum -Minimum

Count    : 31
Average  : 2501,25806451613
Sum      : 77539
Maximum  : 5030
Minimum  : 439
Property : MessageCount

Everything looks great. Let’s do the same, but this time with outbound mail traffic.

Get mail traffic report outbound

Filter report by day

Filter on outbound mail by day. The only difference between the previous cmdlet is to set the value Outbound instead of Inbound.

In this example, we did select June 6, 2023.

PS C:\> Get-MailTrafficATPReport -Direction "Outbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 00:00:00 Message passed Outbound  NotSpam        9            

Filter report by good mail

Filter mail traffic report by the event type Message passed.

PS C:\> Get-MailTrafficATPReport -Direction "Outbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 00:00:00 Message passed Outbound  NotSpam        9            

Filter report aggregate by hour

Add the AggregateBy parameter with the value Hour.

PS C:\> Get-MailTrafficATPReport -Direction "Outbound" -StartDate "06/02/2023 00:00" -EndDate "06/03/2023 00:00" -AggregateBy "Hour"

Date                Event Type     Direction Verdict Source Message Count
----                ----------     --------- -------------- -------------
02/06/2023 10:00:00 Message passed Outbound  NotSpam        9     

Filter report by month

Get good mail for the last month, May 2023, which is 31 days.

PS C:\> Get-MailTrafficATPReport -Direction "Outbound" -StartDate "05/01/2023 00:00" -EndDate "05/31/2023 00:00" -EventType "Message Passed"

Get total outbound messages by month

The total outbound for May 2023 was 131639 messages.

PS C:\> Get-MailTrafficATPReport -Direction "Outbound" -StartDate "05/01/2023 00:00" -EndDate "05/31/2023 00:00" -EventType "Message Passed" -AggregateBy Day | Measure-Object "MessageCount" -Average -Sum -Maximum -Minimum

Count    : 31
Average  : 4246,41935483871
Sum      : 131639
Maximum  : 8878
Minimum  : 251
Property : MessageCount

That’s it!

Read more: How to Allowlist domain in Microsoft 365 »

Conclusion

You learned how to get Exchange Online mail traffic report with PowerShell. By running the Get-MailTrafficATPReport cmdlet, you will have different mail traffic reports with much information. We were looking for the total number of delivered inbound (incoming) and outbound (outgoing) messages a month.

Did you enjoy this article? You may also like How to get mailbox size greater than in Microsoft 365. Don’t forget to follow us and share this article.