View
223
Download
6
Category
Tags:
Preview:
Citation preview
Mitch HallSenior Program ManagerMicrosoft – Office 365
Julie XuPrincipal Group Program ManagerMicrosoft – Office 365
Reporting in Office365
MNG304
AgendaOffice 365 report overviewMailbox, Mail flow and Protection reports
Mailbox, (Distribution) Groups, Protection, Data Loss Prevention, Transport Rules, Message Trace
Non mail related reportsLync, SharePoint, Auditing
How does it work?Other ways to retrieve your data
Remote PowerShellCustom Excel reportingDirect WSAPI programming
What's new?New reports, Interactive summary reports, with drill through detail reports
O365 ReportsOverview
Win Your Trust and ConfidenceConsistent and Complete
In the Know -- provisioning, usage & productivity, security, protection
Dynamic and Rich VisualizationData is easy to understandInteraction is intuitive
Actionable InsightHigh data quality and reliabilityAlways freshEnable and encourage action
Access to Your Data
Manage Your Cloud InvestmentService Life Cycle
Scenario EXO LYO SPO Office365(suite wide)
Buy Provisioning ü üLicenses
Storage ü ü
Consume Device – Software ü
Device – Connections ü
User - Email activity ü
User - Docs activity ü
User - Meetings activity ü
User - External Sharing ü
Exchange Online ServicesMail Activity Reports
Portal DefinitionNumber of active and inactive mailboxes over time. A mailbox is considered inactive if a user has not logged in for more than 30 days. Number of inactive mailboxes are grouped by the number of days the user has not logged in
Technical Definition – Active MailboxMailbox is connected Mailbox has been logged into in past 30 days (from store)OR Mailbox has been created in past 30 days (from AD)
Technical Definition – InActive MailboxMailbox is connected Mailbox has not been logged into in past 30 days (from store)Mailbox was created more than 30 days ago (from AD)
Mailbox Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIStaleMailboxStaleMailboxDetail
CMDLetsGet-StaleMailboxReportGet-StaleMailboxDetailReport
Note!Inactive Mailbox here does not refer to the “inactive” mailbox state as defined by ligation hold. Yes, we know this is very confusing.
Inactive (a.k.a. Stale) Mailbox Report
Portal DefinitionShows the number of total number of mailboxes, inactive mailboxes, mailboxes exceeding their storage quota, and mailboxes using less than 25% of their storage limit.
Technical Definition – Total MailboxSource (AD)All connected Mailboxes
Technical Definition – InActive MailboxMailbox is connected Mailbox has not been logged into in past 30 days (from store)Mailbox was created more than 30 days ago (from AD)
Technical Definition – Exceeds Storage LimitSource AD (MBX limits)Source Store (MBX size)Over limit if MBX total item size is over IssueWarningQuota
Technical Definition – < 25% storageSource AD (MBX limits)Source Store (MBX size)< 25% of ProhibitSendReceiveQuota
Mailbox Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailboxUsageMailboxUsageDetail
CMDLetsGet-MailboxUsageReportGet-MailboxUsageDetailReport
Mailbox Usage Report
Portal DefinitionShows the number of mailbox connections made over time, grouped by connection types.
Technical Definition – ProtocolsMAPI, OWA, EAS, EWS, IMAP, POP3
Technical Definition – Protocol CountCafé (CAS) logs for each protocol Distinct MBX accessed per dayAggregated daily
Mailbox Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIConnectionByClientType (daily, weekly, monthly, yearly)ConnectionbyClientTypeDetail
CMDLetsGet-ConnectionByClientTypeReportGet-ConnectionByClientTypeDetailReport
Types of Mailbox Connections
Portal DefinitionShows the number of active mailboxes, and the number of mailboxes created and deleted. A mailbox is considered active if a user has accessed it at least once in the last 30 days.
Technical Definition – Total Active MailboxMailbox is connected Mailbox has been logged into in past 30 days (from store)OR Mailbox has been created in past 30 days (from AD)
Technical Definition –Mailbox CreatedSource (AD)Mailbox was created or reconnected in a dayDoes not count inter-day soft-deletes/restoresAggregated daily
Technical Definition –Mailbox DeletedSource (AD)Mailbox was soft deleted or removed in a dayDoes not count inter-day soft-deletes/restoresAggregated daily
Mailbox Level Details – Not AvailableSummary Via Reporting Web Service and CMDLets
Web Service/ODATA APIMailBoxActivity (daily, weekly, monthly, yearly)
CMDLetsGet-MailboxActivityReport
New and Deleted Mailboxes
Portal DefinitionShows the number of groups created and deleted.
Technical Definition – Group CreatedSource (AD)Groups created daily (WhenCreated==Today)Does not currently include DDGs (planned)Aggregated daily.
Technical Definition –Mailbox DeletedSource (AD)Groups deleted daily (WhenDeleted==Today)Does not currently include DDGs (planned)Aggregated Daily.
Group Level Details – Not AvailableSummary Via Reporting Web Service and CMDLets
Web Service/ODATA APIGroupActivity (daily, weekly, monthly, yearly)
CMDLetsGet-GroupActivityReport
New and Deleted Groups
Exchange Online ServicesMail Protection Reports
Portal DefinitionShows received mail based on traffic type
Technical DefinitionsGood Mail - messages that were received and not identified as spam or malwareSpam - messages identified as spam Malware - messages that contained malware Transport rules - messages that matched at least one rule DLP - messages that matched at least one DLP policy
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypesGoodMailMalwareTransportRuleHitsSpamEnvelopeBlockSpamIPBlockSpamContentFiltered
Sent/Received Mail Report
Portal DefinitionShows what spam was detected, grouped by spam filtering type.
Technical DefinitionsSMTP Blocked- Sender and recipient filteringIP Blocked -The reputation of the connecting IP address is evaluated by means of lists from partners and third-party providersContent filtered - content is checked for terminology or properties common to spam
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypesSpamEnvelopeBlockSpamIPBlockSpamContentFiltered
Spam Report
Portal DefinitionShows the number of malware detections in received mail, before the malware action was applied
Technical DefinitionsViruses infect other programs and data, and they spread throughout your computer looking for programs to infect.
Spyware refers to malware that gathers your personal information, such as sign-in information and personal data, and sends it back to its author.
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypeMalware
Malware Report
Portal DefinitionShows the number of transport rule matches in received mail, grouped by severity.
Technical DefinitionsSeverity is defined by the admin for each transport rule created
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypeTransportRuleHits
Transport Rule Report
Portal DefinitionShows the number of transport rule matches in received mail, grouped by severity.
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypeDLPPolicyHitsDLPPolicyOverrideDLPPolicyFalsePositive
Data Loss Prevention Summary Report Technical Definitions
Policy Matches: daily count of DLP policies that were matched.Overrides: daily count of the DLP Policies that were overridden by the user.False Positive: Daily count of DLP Policies that were reported as False Positive
Portal DefinitionShows the number of DLP rule matches in received mail, grouped by severity.
Technical DefinitionsSeverity is defined by the admin for each transport rule created
Mail Level DetailsVia Reporting Web Service and CMDLets
Web Service/ODATA APIMailTraffic
CMDLetsGet-MailTraffic
EventTypeDLPPolicyRuleHits
Data Loss Prevention Rule Report
Non Mail Reports
SharePoint reportsOneDrive for Business sites
Shows the number of active and inactive OneDrive for Business sites
OneDrive for Business storage Shows used vs. allocated storage space for OneDrive for Business sites
Team sites deployedShows the number of active and inactive team sites
Team site storage Shows used vs. allocated storage space for team sites
Tenant storage metrics Shows used, allocated, and total storage space for the entire tenant
Lync reportsActive and inactive users/audio sessions
Shows the total number of unique users who signed in and took part in a peer-to-peer session or conference.
Audio/video conference minutesShows the total number of minutes users spent in audio\/video conferences over time.
Application sharingShows the number of application sharing, web, and dial-in conferences over time.
How Does it Work
How does it work
Exchange
EOP
SPO
LYO
Mail Traffic
ReportingDatamarts
Report Data
ReportData
ReportData
ReportData
ReportingWebService
(odata)
O365Report Console
PowerShell
O365Console
WSAPI
RemotePowerShell
Mail Traffic
Access data via O365
Exchange
EOP
SPO
LYO
Mail Traffic
ReportingDatamarts
Report Data
ReportData
ReportData
ReportData
ReportingWebService
(odata)
O365Report Console
PowerShell
O365Console
WSAPI
RemotePowerShell
Mail Traffic
Office 365 reportsDemo
O365 Remote PowerShell
Access data via PowerShell
Exchange
EOP
SPO
LYO
Mail Traffic
ReportingDatamarts
Report Data
ReportData
ReportData
ReportData
ReportingWebService
(odata)
O365Report Console
PowerShell
O365Console
WSAPI
RemotePowerShell
Mail Traffic
Remote PowerShellDemo
Web Service API
Access data via WSAPI
Exchange
EOP
SPO
LYO
Mail Traffic
ReportingDatamarts
Report Data
ReportData
ReportData
ReportData
ReportingWebService
(odata)
O365Report Console
PowerShell
O365Console
WSAPI
RemotePowerShell
Mail Traffic
Access to data via Excel
All reporting endpoints are public facing odata feed
Excel 2013 has the ability to pull Odata feeds and interact with the data
Excel ReportDemo
Custom ApplicationDemo
O365 ReportingEnhancements
What's new – Spring 2014Client side rendering
Allows for greater interactivity with the data. Provides ability to slice data to see spikes or trends
Access to detail recordsTo analyze a trend or spike, you can click through to associated detail data.
Access to historical dataFor data that’s a bit older, you can submit a request to provide the data via download.
Browser/OS report
Browser/OS ReportDemo
Enhanced ReportingDemo
O365 Future Reports
Future reportsExchange ActiveSync Device Reports
Mobile PlatformShows historical trends of devices broken down by mobile OS families. This report will allow a drill down on OS versions and device models.
Device Activity: Shows historical trends of what devices have been blocked due to compliancy or were quarantined
OneDrive for Business ReportsFiles and Folders Activity LogsShows who did what and when to a file and folder stored in OneDrive for Business. This report will answer the following question: what happened to my file?
User Storage and Quota: Shows at the user level, allocated and used storage quota
Future auditing reportsAzure Active Directory logs
This report will contain the following items: User, Group, Device, and Licensing CRUD, Change auth or password policies, Change Company/Partner/DirSync Info
SharePoint tenant admin plus site collection admin logsThis report will contain SharePoint Tenant admin and Site Collection admin logs
SharePoint Site user logsThis report will contain SharePoint site user usage logs
OneDrive for Business tenant admin/user logsThis report will contain OneDrive for Business tenant admin logs
OneDrive for Business user logsThis report will contain OneDrive for Business user logs
DC Admin activity logs across Exchange, SharePoint and OneDrive for Business
Today we only provide DC admin logs for Exchange. This report will provide DC admin logs across Exchange, SharePoint and OneDrive for Business
TakeawaysConfidence
Confidence that when you move to the Office 365 service you still have total control of your user experience.
InsightsOffice 365 services offer you valuable insights to assure your that your investment provides a valuable return.
ActionEasy access to data, ability to analyze data quickly allows you to take timely action.
Ongoing improvementsMicrosoft will continue to invest in additional reports and capabilities that will provide greater access and flexibility to access your data
Multiple ways to access your dataO365 admin console, PowerShell, WSAPI(Excel, custom app)
Useful links
Reportshttp://technet.microsoft.com/en-us/library/office-365-reports.aspx
Remote PowerShellhttp://technet.microsoft.com/en-us/library/
jj984289(v=exchg.150).aspxhttp://technet.microsoft.com/en-us/library/
dn621039(v=exchg.150).aspx
MSDN docs for WASPIhttp://msdn.microsoft.com/en-us/library/office/jj984321.aspx
Similar Sessions to Attend Session Title Timing Room
SPR.202 Encryption in ExchangeTue 10:45 AM - 12:00 PM Ballroom E
SPR.201
Eliminate the Regulatory Compliance Nightmare
Tue 9:00 AM-10:15 AM MR 19ab
SPR.UN.305
Exchange Online Protection: Notes from the field
Wed 10:15 AM – 11:30 AM Ballroom G
SPR.UN.304Experts Unplugged: EOP & Encryption
Wed 8:30-9:45 AMWed 1:00-2:15 PM
MR 18dMR 17b
SPR.401
Extending Data Loss Prevention For Your Business
Wed 4:45 PM- 6:00 PM MR 18bc
SPR.203
Protect your Organization with Exchange Online Protection (EOP)
Mon 4:30 PM - 5:45 PM MR 18bc
SPR.301So how does Microsoft handle my spam?
Tue 4:45 PM – 6:00 PM MR 19ab
SPR.401Using Connectors & Mail Routing
Wed 2:45 PM - 4:00 PM MR 18bc
Similar Sessions to Attend Session Title Timing Room
SPR.202 Encryption in ExchangeTue 10:45 AM - 12:00 PM Ballroom E
ARC.304Exchange Server 2013 Transport Architecture Tues 9:00 AM - 10:15 AMBallroom F
EDC.302Advanced Data Loss Prevention in Exchange Tues 1:30 PM-2:45 PM Ballroom F
EDC.UN.301Experts Unplugged: Data Loss Prevention
Tue 3:00 PM-4:15 PMWed 10:15 AM-11:30 AM
MR 18dMR 13ab
EDC.204Data Loss Prevention in Exchange, Outlook, OWA Mon 2:45 Pm-4:00PM MR 18bc
MNG.304Reporting On O365 Mail flow and Mailbox Data Wed 1:00 PM-2:15 PM MR 17a
MNG.301Exchange Admin Center - getting administration done
Wed 10:15 AM - 11:30 AM MR 18bc
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
Recommended