Table of Contents
Antiquated Report Revived Because of Customer Feedback (But Better Alternatives Exist)
Updated April 2022 with details of the new location for the Top Senders report and Top Recipients report in the Microsoft 365 Defender portal
Microsoft published an update to message center notification MC237975 on April 22, 2021 to cancel the proposed retirement of the Top Senders report and the Top Recipients report and its associated PowerShell cmdlet (Get-MailTrafficSummaryReport) previously advised on February 5, 2021. According to the update, Microsoft based its decision on customer feedback, which means that some customers must like the report and the cmdlet. I am mystified why this is so. It’s a simply horrible report. In their defense, those advocating its retention must not understand that better alternatives exist.
Reports in the Microsoft 365 Defender Portal
Originally located in the Office 365 Security and Compliance Center (SCC), the Top Senders report and Top Recipients report are now found under Email & Collaboration in the Reports section of the Microsoft 365 Defender portal. The reports section is organized into a series of widgets, each representing a report. The Top Senders and Recipients report can look back 90 days (the period for which Exchange Online preserves message trace data) and the data it presents is moderately interesting (Figure 1).

The Top Senders report and Top Recipients report and the underlying cmdlet are old (the cmdlet dates to at least 2015) and Microsoft has given them little or no tender loving care since. The data presented in the reports in the old SCC including all sorts of crud, such as message sent to replicate public folders between public folder mailboxes, updates sent by SharePoint Online when users share documents, and so on. You can’t apply a filter to remove all the system junk from the data, so you end up with useless statistics such as public folder replication represents 80.77% of all send message activity over the last 90 days. Thankfully, Microsoft applies better filters to the reports available in the Microsoft 365 Defender portal.
However, the Top Senders and Top Recipients reports don’t take account of recent advances such as plus addressing and the support in Exchange Online to allow users to send messages using any proxy address assigned to their mailbox. Each plus and proxy address is listed separately instead of being grouped under the mailbox.
It’s not difficult to filter out messages like those for system, group, and shared mailboxes to create a report based on mailbox activity. Take the PowerShell example below, which uses the Get-MailTrafficSummaryReport cmdlet to create two arrays of sender and recipient data for the last 90 days. After fetching the set of user mailboxes in the tenant, we loop through each mailbox to calculate the total number of messages sent and received. Because we focus solely on messages sent and received by user mailboxes, this approach excludes any system-generated traffic.
$StartDate = (Get-Date).AddDays(-92); $EndDate = (Get-Date).AddDays(+1) [array]$SenderData = Get-MailTrafficSummaryReport -Category TopMailSender -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 [array]$RecipientData = Get-MailTrafficSummaryReport -Category TopMailRecipient -StartDate $StartDate -EndDate $EndDate | Select-Object C1, C2 $MbxReport = [System.Collections.Generic.List[Object]]::new() [array]$Mbx = Get-ExoMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited ForEach ($M in $Mbx) { Write-Host "Processing" $M.DisplayName # Check each email proxy address to see if it was used to send email [int]$TotalSentMessages = 0 ; [int]$Messages = 0 ForEach ($A in $M.EmailAddresses) { If ($A.Substring(0,4) -eq "smtp") { $Messages = $SenderData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2 # Write-Host "Messages found for" $A " " $Messages $TotalSentMessages = ($TotalSentMessages + $Messages) } } # Check each email proxy address to see if it was used to receive email [int]$TotalReceivedMessages = 0 ; [int]$Messages = 0 ForEach ($A in $M.EmailAddresses) { If ($A.Substring(0,4) -eq "smtp") { $Messages = $RecipientData | ? {$_.C1 -eq $A.Split(":")[1] } | Select -ExpandProperty C2 Write-Host "Messages found for" $A " " $Messages $TotalReceivedMessages = ($TotalReceivedMessages + $Messages) } } $ReportLine = [PSCustomObject] @{ User = $M.DisplayName Address = $M.UserPrincipalName "Sent messages" = $TotalSentMessages "Received messages" = $TotalReceivedMessages } $MbxReport.Add($ReportLine) } $MbxReport | Out-GridView
Figure 2 shows the output from the script. You can download a copy of the script from the Office 365 for IT Pros GitHub repository.

The Modern Usage Reporting Option
I imagine that the customers who protested the removal of the Top Senders and Recipients report did so because they use the report. Well, a better mousetrap exists for reports about user activity: the Microsoft Graph Reports API. The most important reason why is that the Graph API is the focus for future Microsoft development. The old Office 365 data warehouse, used as the basis for the older Exchange-based usage cmdlets, will eventually disappear.
The Exchange usage report in the Microsoft 365 admin center (Figure 3) is the closest to the Top Senders and Recipients report. It’s not perfect (what do “receive actions” really mean in terms of the number of messages received by a mailbox?), but it’s a good start. The data doesn’t line up exactly with what’s reported in the Microsoft 365 Defender portal. Usually, the Graph-based data for messages sent and received comes in under the figures reported by the Microsoft 365 Defender portal, but I’m willing to put that down to inconsistencies in the Office 365 data warehouse. In any case, tracking data about user activities is like using a personal step counter. The data might vary from device to device depending on how a device accounts for factors like stride length, but once you use the same device on a consistent basis, you have something to compare progress against.

The usage reports in the Microsoft 365 admin center use the Graph API and support features like the deidentification of personal user information. They also support going back 180 days instead of 90 days, and because the reports use a fully supported API, you can write your own code to generate the type of usage reports you want. An example of this is the per-user activity report spanning multiple Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams, and Yammer) written using a combination of PowerShell and Graph API calls.
Time to Switch from the Old Reports
If you’re one of the customers discommoded by Microsoft’s plan to retire the Top Senders and Recipients report, it’s time for you to consider looking at the replacements which already exist within Microsoft 365. The reports available in the admin center might be different, but the usage data is there. And if you don’t like what you see, consider investing some time to develop familiarity with the Microsoft Graph Reports API, maybe using PowerShell. The Graph is the future; the old reports will eventually disappear. Why stay fixed in the past when the future beckons?
We offer insights like this throughout the 24 chapters of the Office 365 for IT Pros eBook. It’s one of the reasons why our subscribers stay on top of new developments inside Office 365.
Seriously? better alternatives? powershell? How about Microsoft actually retains one of the few useful tools in O365 for administrators
I’m going to guess that the person who wrote this article is a developer with a lot of spare time on his hands, rather than a day-to-day system administrator. What administrators need is a quick at-a-glance graphical representation of particular types of activities, especially when management asks for a report ASAP.. Most of us do NOT have the free time to develop PowerShell scripts to customize the data extraction we often need at a moment’s notice. The writer’s condescending attitude is unwelcome, and this article is entirely unhelpful.
Hello, thaks for this usefull article. Is there a way get a “per sending domains” based report? More exactly how many emails were sent out from eatch of the mail domains owned by the company?
Thanks.
You could calculate this information by analyzing the message trace logs (https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac). You’d export the logs and then run some PowerShell to extract the lines for successful message sends and analyze the domains used by the message submitters. At least, that’s what I think you’d do.
Is there anyway to use Graph API specifically “/reports/getEmailActivityCounts(period=’D7′)” to get a “per sending domains” based report?
Like this? https://practical365.com/mail-activity-usage-data-domains/
That’s exactly what I’m looking for, but unfortunately I keep running into a Forbidden 403. Even after granting delgated and application permissions to my app.
You’re using an app to retrieve the information? What permissions are you using?
I’m using Reports.ReadAll. That’s the only permission that’s mentioned in the documentation.
https://learn.microsoft.com/en-gb/graph/reportroot-authorization says “Microsoft 365 usage reports are protected by both permissions and Microsoft Entra roles.” Does the signed in account have a role that allows access to reports data?