Configuring Microsoft 365 Group Privacy with PowerShell
Introduction
In the modern collaborative workspace, Microsoft 365 Groups play an integral role. They facilitate inter-departmental communications, project collaborations, and the seamless sharing of documents. However, as with all tools, their effective management is crucial, especially when it comes to data privacy and security.
The Challenge: Ensuring Group Privacy
PowerShell to the Rescue
Here’s a simple yet powerful script to change the visibility of all ‘Public’ Microsoft 365 Groups to ‘Private’:
# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName <YourAdminUPN> -ShowProgress $true
# Retrieve all public Microsoft 365 Groups and change their visibility to private
$publicGroups = Get-UnifiedGroup -ResultSize Unlimited | Where-Object { $_.AccessType -eq "Public" }
foreach ($group in $publicGroups) { Set-UnifiedGroup -Identity $group.Identity -AccessType Private Write-Output "Updated group $($group.DisplayName) to private"
}Breaking Down the Script
- Connect-ExchangeOnline: This cmdlet establishes a session with Exchange Online, a necessary step since Microsoft 365 Groups are mailbox-enabled objects in Exchange Online.
- Get-UnifiedGroup: This cmdlet fetches all Microsoft 365 Groups. The
-ResultSize Unlimitedparameter ensures we retrieve all groups without any default limitations. - Where-Object: This filters out only the public groups from our fetched list.
- Set-UnifiedGroup: This cmdlet changes the visibility setting of each public group to private.
Conclusion
Use Filter parameter with Get-Mailbox in PowerShell
You can change the PowerShell display output using the -Filter parameter with the Get-Mailbox cmdlet. It helps you to find a specific mailbox without knowing the exact name.
Get list of user mailboxes
Get-Mailbox -Filter '(RecipientTypeDetails -eq "UserMailbox")' -ResultSize Unlimited | Select-Object Identity, UserPrincipalName, AliasGet list of shared mailboxes
Get-Mailbox -Filter '(RecipientTypeDetails -eq "SharedMailbox")' -ResultSize Unlimited | Select-Object Identity, UserPrincipalName, AliasGet list of room mailboxes
Run the below PowerShell command to show all room mailboxes.
Get-Mailbox -Filter '(RecipientTypeDetails -eq "RoomMailbox")' -ResultSize Unlimited | Select-Object Identity, UserPrincipalName, AliasGet list of equipment mailboxes
Run the below PowerShell command to show all equipment mailboxes.
Get-Mailbox -Filter '(RecipientTypeDetails -eq "EquipmentMailbox")' -ResultSize Unlimited | Select-Object Identity, UserPrincipalName, AliasFind mailbox with wildcard
In our example, we want to find all the mailboxes with the letters “al” in their name. You need to use a wildcard to find the string values.
Note: Not all the properties accept the wildcard asterisk (*). See the entire list of filterable properties in Exchange Online PowerShell.
- Use an asterisk (*) before and after the letters
Run the below PowerShell command.
Get-Mailbox -ResultSize Unlimited -Filter {Alias -like '*al*'} | Format-Table -AutoSizeThe PowerShell result is shown below.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
Catch All Catch.All EURPR02DG588-db346 49.5 GB (53,150,220,288 bytes) 182292ee-eaec-438b-bf14-f25dec9cf1cd
12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b Ken.Walker EURPR02DG393-db032 99 GB (106,300,440,576 bytes) 12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b
e5c3a5e8-eeae-4829-94dc-fb7228bcf8da Ryan.Walker EURPR02DG514-db387 99 GB (106,300,440,576 bytes) e5c3a5e8-eeae-4829-94dc-fb7228bcf8daIt shows all the mailboxes that include the letters “al” in their Alias.
Option 2: Find mailbox using wildcard at the beginning of string value
Get all the mailboxes that start with the letters “an” in their name.
- Use an asterisk (*) after the letters
Run the PowerShell command example.
Get-Mailbox -ResultSize Unlimited -Filter "Alias -like 'an*'" | Format-Table -AutoSizeSee the PowerShell output result.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
82cd0d62-e974-4892-aca6-e0387abc62be Anna.Bell EURPR02DG037-db046 99 GB (106,300,440,576 bytes) 82cd0d62-e974-4892-aca6-e0387abc62be
5cae3874-442b-459c-8f33-3aee5b879275 Anne.Butler EURPR02DG275-db096 99 GB (106,300,440,576 bytes) 5cae3874-442b-459c-8f33-3aee5b879275It shows all the mailboxes that start with the letters “an” in their Alias.
Option 3: Find mailbox using wildcard at the end of string value
Get all the mailboxes that end with the letters “er” in their name.
- Use an asterisk (*) before the letters
Run the PowerShell command example.
Get-Mailbox -ResultSize Unlimited -Filter "Alias -like '*er'" | Format-Table -AutoSizeSee the PowerShell output result.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
5cae3874-442b-459c-8f33-3aee5b879275 Anne.Butler EURPR02DG275-db096 99 GB (106,300,440,576 bytes) 5cae3874-442b-459c-8f33-3aee5b879275
b602b148-2fcf-435a-9d34-ce72c3a8c748 Diana.Baker EURPR02DG060-db131 99 GB (106,300,440,576 bytes) b602b148-2fcf-435a-9d34-ce72c3a8c748
12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b Ken.Walker EURPR02DG393-db032 99 GB (106,300,440,576 bytes) 12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b
e5c3a5e8-eeae-4829-94dc-fb7228bcf8da Ryan.Walker EURPR02DG514-db387 99 GB (106,300,440,576 bytes) e5c3a5e8-eeae-4829-94dc-fb7228bcf8da
c32b2b27-d809-439a-a3e3-eb7a749eeb72 Stephen.Hunter EURPR02DG597-db438 99 GB (106,300,440,576 bytes) c32b2b27-d809-439a-a3e3-eb7a749eeb72It shows all the mailboxes that end with the letters “er” in their Alias.
Get all inactive mailboxes
You can also check if there are any inactive mailboxes in your organization using the -Filter parameter.
Run the below PowerShell command example.
Get-Mailbox -ResultSize Unlimited -Filter 'IsInactiveMailbox -eq $True' | Format-Table UserPrincipalName, Identity, IsInactiveMailboxThe PowerShell output result.
UserPrincipalName Identity IsInactiveMailbox
----------------- -------- -----------------
Amanda.Morgan@m365info.com 41377e9c-dc47-46c0-b4a5-1d5bbdcb5dd5 True
Carlos.Baker@m365info.com 82cd0d62-e974-4892-aca6-e0387abc63be True
Mike.Shawn@m365info.com 5cae3874-442b-459c-8f33-3aee5b879175 True
Trevor.Smith@m365info.com 0f38d53f-cbe0-4844-86e9-1032a45ba51b TruePrerequisites to Run the Get-MessageTrackingLog Cmdlet
- Access Exchange Online: Use a valid Microsoft Account with administrative credentials to establish a connection to Exchange Online PowerShell – we’ll show you how to do it below;
- Execute the Get-ManagementRole Command: Upon successfully logging into your Microsoft Account, execute the following command: Get-ManagementRole -Cmdlet <Cmdlet>. Substitute <Cmdlet> with Get-MessageTrackingLog;
- Verify Necessary Permissions: Post-execution, PowerShell will display the roles required to run Get-MessageTrace. If there’s a need for additional roles or permissions, reach out to your organization’s administrator for further guidance.
Filtering and Limits
[array]$Mailboxes = Get-ExoMailbox -Filter {Office -eq "Dublin"} -RecipientTypeDetails UserMailbox -ResultSize Unlimited[array]$Users = Get-MgUser -Filter "assignedLicenses/`$count ne 0 and userType eq 'Member' and OfficeLocation eq 'Dublin'" -ConsistencyLevel eventual -CountVariable Records -All
Nevertheless, the point remains that the golden rule is to only fetch the data you need to process. Using good filters is the best way to accomplish this goal.
Lots More to Learn about Microsoft 365 PowerShell
Hopefully, you’ll find that the many Practical365.com articles we publish about using PowerShell to get real work done help. And if you want to browse code, feel free to look through my GitHub repository. You might even find some working code there.
Get-MessageTrackingLog vs. Get-MessageTrace
Get-MessageTrackingLog and Get-MessageTrace are two similar yet different cmdlets in the PowerShell environment.
Both commands work to analyze and check message tracing information; still, the differences are noticeable:
1. Deployment Environment:
- Get-MessageTrackingLog is designed for on-premises Exchange environments and is available in Exchange Server versions;
- Get-MessageTrace is tailored for cloud-based services and is available in Exchange Online and Exchange Online Protection. It operates specifically within the cloud-based organization.
2. Date Range and Historical Search:
- Get-MessageTrackingLog allows searching message data without specific limitations on the date range. Administrators can search the message tracking logs without being constrained by a predefined timeframe;
- Get-MessageTrace limits the search to the last 10 days of message data. If you need to search for data older than 10 days, you are required to use the Start-HistoricalSearch and Get-HistoricalSearch cmdlets.
3. Result Output and Time Format:
- Get-MessageTrackingLog returns results in the form of a comma-separated value (CSV) file, allowing administrators to manipulate and analyze the data easily. The output includes fields like Timestamp, Recipients, and Sender;
- Get-MessageTrace returns results with timestamps in UTC time format. Additionally, it limits the maximum number of returned results to 1000 by default and may timeout on very large queries. Administrators are advised to consider splitting up queries for large datasets using smaller date intervals.
Get all mailboxes in Out-Gridview
We will get all the Exchange Online mailboxes and send the output to an interactive table (Out-GridView).
Run the below PowerShell command.
Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName, Alias, Identity, RecipientTypeDetails | Out-GridView -Title "All Mailboxes"The Out-GridView appears with a detailed list of mailboxes where you can filter and search the results.

What Can You Use Get-MessageTrackingLog For?
Get-MessageTrackingLog retrieves message tracking logs that exist for the Transport service on a Mailbox server, for the Mailbox Transport service on a Mailbox server, and on an Edge Transport server.
- Troubleshooting Email Delivery Issues: Use Get-MessageTrackingLog to investigate and troubleshoot email delivery problems. It provides detailed information about the status and events of messages as they traverse the mail flow;
- Auditing and Compliance Monitoring: Monitor and audit email communication within the organization for compliance purposes. Get-MessageTrackingLog helps track the movement of emails, providing an audit trail for compliance and regulatory requirements;
- Security Analysis and Threat Detection: Analyze message tracking logs to identify and investigate potential security threats. The cmdlet allows administrators to review email activities and detect anomalies or suspicious patterns that may indicate security incidents;
- Performance Monitoring and Optimization: Monitor the performance of the email system by reviewing message tracking logs. Analyzing the logs can help identify areas for optimization, such as optimizing mail flow, addressing delivery delays, or improving overall system efficiency;
- Reporting and Trend Analysis: Generate reports and conduct trend analysis on email communication. Get-MessageTrackingLog can be used to extract data for reporting purposes, helping administrators understand email usage patterns, peak activity times, and other trends.
Reporting Objects
Eventually, a script extracts all the required data and it’s time to generate some form of report. Some of the common ways to make the output generated by a script available to people include:
These actions mark the final stage of a script. Before a script can post, send, or store anything, the data retrieved from objects must be held in a PowerShell object, usually an array or a list.
I use the same approach to record data in all scripts. First, I create a PowerShell list:
$Report = [System.Collections.Generic.List[Object]]::new()
Then, after the script processes an object, the data to capture is handled by populating the properties of a custom object and writing it to the list. In performance terms, this approach is better than adding items to an array because PowerShell recreates the array for each addition. That’s OK for a couple of items but not so good when dealing with thousands. Updating the list is simple. For instance:
$ReportLine = [PSCustomObject]@{ TimeStamp = $M.Received Sender = $M.SenderAddress Recipient = $M.RecipientAddress Subject = $M.Subject Status = $M.Status Direction = $Direction SenderDomain = $SenderDomain RecipientDomain = $RecipientDomain }
$Report.Add($ReportLine)The output list is easy to work with and easy to transform into other forms. For instance, to include the data in a HTML file, the script can convert the list like this:
$HTMLData = $Report | ConvertTo-HTML -Fragment
Get-EXOMailbox PowerShell cmdlet
You can use the Get-EXOMailbox cmdlet to retrieve results faster than the Get-Mailbox cmdlet. However, it doesn’t work in Exchange Server on-premises and it only works in Exchange Online.
Note: We recommend using the Get-EXOMailbox cmdlet for better performance and reliability.
All module versions contain nine exclusive Get-EXO* cmdlets for Exchange Online PowerShell optimized for speed in bulk data retrieval.
See the below list with the improved Exchange Online PowerShell cmdlets that are available only in the module.
| EXO module cmdlet | Older related cmdlet |
|---|---|
| Get-EXOMailbox | Get-Mailbox |
| Get-EXORecipient | Get-Recipient |
| Get-EXOCasMailbox | Get-CASMailbox |
| Get-EXOMailboxPermission | Get-MailboxPermission |
| Get-EXORecipientPermission | Get-RecipientPermission |
| Get-EXOMailboxStatistics | Get-MailboxStatistics |
| Get-EXOMailboxFolderStatistics | Get-MailboxFolderStatistics |
| Get-EXOMailboxFolderPermission | Get-MailboxFolderPermission |
| Get-EXOMobileDeviceStatistics | Get-MobileDeviceStatistics |
We will use the Get-Mailbox cmdlet to view mailbox object information. When you use the Get-Mailbox cmdlet to display information about mailboxes, the information will be displayed in a table format.
Run the most basic PowerShell cmdlet.
Get-MailboxThe PowerShell output is based on a predefined output format with a header for each property.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
41377e9c-dc47-46c0-b4a5-… Amanda.Hansen EURPR02DG549-db028 99 GB (106,300,440,… 41377e9c-dc47-46c0-b4a5-1d5bbdcb5cc5
82cd0d62-e974-4892-aca6-… Anna.Bell EURPR02DG037-db046 99 GB (106,300,440,… 82cd0d62-e974-4892-aca6-e0387abc62be
5cae3874-442b-459c-8f33-… Anne.Butler EURPR02DG275-db096 99 GB (106,300,440,… 5cae3874-442b-459c-8f33-3aee5b879275
0f38d53f-cbe0-4844-86e9-… Brenda.Smith EURPR02DG598-db076 99 GB (106,300,440,… 0f38d53f-cbe0-4844-86e9-1032a45ba31b
411a8f10-0dfa-4034-a1e3-… Brian.Mill EURPR02DG558-db051 99 GB (106,300,440,… 411a8f10-0dfa-4034-a1e3-a8b6e4cad2f6
52a6c1c7-77d2-4109-99b9-… Carl.Hawk EURPR02DG234-db124 99 GB (106,300,440,… 52a6c1c7-77d2-4109-99b9-a4076167b6e2
Catch All Catch.All EURPR02DG588-db346 49.5 GB (53,150,220… 182292ee-eaec-438b-bf14-f25dec9cf1cd
d5dc703a-45d0-4dc3-89ba-… Charles.Mitchel EURPR02DG517-db333 99 GB (106,300,440,… d5dc703a-45d0-4dc3-89ba-16f088925e41
b602b148-2fcf-435a-9d34-… Diana.Baker EURPR02DG060-db131 99 GB (106,300,440,… b602b148-2fcf-435a-9d34-ce72c3a8c748It shows the Name, Alias, Database, Mailbox size quota, and Object ID for each mailbox.
Get all existing mailboxes information
When you use the Get-Mailbox cmdlet without specifying anything, it will not show all the existing mailboxes in your organization. If you have many mailboxes, you must add the -ResultSize parameter with the value Unlimited.
Get a list of all the existing mailboxes with the below PowerShell command.
Get-Mailbox -ResultSize UnlimitedThe PowerShell output displays a complete list of all the existing mailboxes in Exchange Online.
Count total mailboxes
Count the number of Exchange Online mailboxes.
(Get-Mailbox -ResultSize Unlimited).CountThe PowerShell output shows the number of mailboxes.
Get single mailbox information
To get information about a specific mailbox, you must provide the -Identity parameter.
You can use one of the below values that identify the mailbox:
- Name
- Alias
- Distinguished name (DN)
- Canonical DN
- Domain
- Email address
- GUID
- LegacyExchangeDN
- SamAccountName
- User ID or user principal name (UPN)
Use the PowerShell command syntax.
Get-Mailbox -Identity "identity"Run the PowerShell command example.
Get-Mailbox "Brenda.Smith@m365info.com"The PowerShell output result is displayed in a table format with a predefined header for each object property.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
0f38d53f-cbe0-4844-86e9-… Brenda.Smith EURPR02DG598-db076 99 GB (106,300,440,… 0f38d53f-cbe0-4844-86e9-1032a45ba31bIt shows the Name, Alias, Database, Mailbox size quota, and Object ID for a single mailbox.
Get disabled mailboxes
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.AccountDisabled -eq $true } | Format-Table Alias, UserPrincipalName, AccountDisabledGet inactive mailboxes
Get-Mailbox -InactiveMailboxOnly -ResultSize Unlimited | Format-Table DisplayName, PrimarySMTPAddress, WhenSoftDeletedGet mailbox archive status
Get all mailboxes with an active archive mailbox.
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ArchiveStatus -eq 'Active' } | Format-Table UserPrincipalName, RecipientTypeDetails, ArchiveStatusGet all mailboxes with an inactive archive mailbox.
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.ArchiveStatus -ne 'Active' } | Format-Table UserPrincipalName, RecipientTypeDetails, ArchiveStatusGet mailbox last logon time
Get all mailboxes with their last logon time.
Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Where-Object { $_.LastLogonTime } | Format-Table DisplayName, LastLogonTimeGet-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Where-Object { $_.LastLogonTime –le ((Get-Date).AddMonths(-2)) } | Format-Table DisplayName, LastLogonTimeGet mailbox created date and time
Get all mailboxes with their created date and time
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.WhenCreated } | Format-Table UserPrincipalName, WhenCreatedGet all mailboxes that were created within the last 2 years from the current date.
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.WhenCreated –ge ((Get-Date).AddYears(-2)) } | Format-Table UserPrincipalName, WhenCreatedGet hidden mailboxes from Global Address List (GAL)
Get all mailboxes that are hidden from the Global Address List (GAL).
Get-Mailbox -ResultSize Unlimited | Where-Object { $_.HiddenFromAddressListsEnabled -eq $true } | Format-Table UserPrincipalName, HiddenFromAddressListsEnabledGet mailboxes with forwarding rules
Get all mailboxes that have forwarding addresses configured to internal or external recipients.
Get-Mailbox -ResultSize Unlimited | Where-Object { ($_.ForwardingAddress -ne $null) -or ($_.ForwardingSmtpAddress -ne $null) } | Format-Table UserPrincipalName, ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForwardGet soft-deleted mailboxes
Get all mailboxes that are soft-deleted.
Get-Mailbox -ResultSize Unlimited -SoftDeletedMailbox | Format-Table Name, Alias, IsSoftDeletedByRemove, IsInactiveMailboxGet mailboxes time zone and language
Get all mailboxes with their time zone and language.
Get-Mailbox -ResultSize Unlimited | Get-MailboxRegionalConfiguration | Format-Table Identity, Language, DateFormat, TimeFormat, TimeZoneWhat is Get-MessageTrackingLog?
Get-MessageTrackingLog is a PowerShell cmdlet used in Microsoft Exchange Server environments to retrieve information from the message tracking logs.
The Get-MessageTrackingLog command is a fundamental part of message tracking in Exchange ecosystems, as it provides access to a comma-separated value (CSV) file that contains detailed information about the history of each email message as it travels through an Exchange server.
Connect to Exchange Online
Before you start, you need to Install Exchange Online PowerShell module.
Connect-ExchangeOnlineHow to Use Get-MessageTrackingLog
Step 1: Connect to Exchange Online PowerShell
Step 2: Run Get-MessageTracking Log
To run the Get-MessageTrackingLog command, it is necessary to specify a few parameters that will retrieve the desired message log reports.
Some parameters include the server mailbox, range of dates, sender information, receiver email addresses, and more.
Step 3: Review the Output and Tracking Log
Once you’ve run the command, you’ll see the tracking logs on screen. However, you can get this tracking log in a CSV file if needed as well.
In the previous example, the output would look something like this:
How Are You? |
- The Timestamp column represents the date and time of the message event;
- Sender indicates the email address of the sender ([email protected]);
- Recipients shows the email addresses of the recipients;
- MessageSubject displays the subject of the email;
- EventId specifies the event type, such as “RECEIVE” for incoming messages and “SEND” for outgoing messages;
- TotalBytes represents the total size of the email message in bytes;
- MessageLatency indicates the time taken for the message to traverse the system, typically measured in seconds.
You can see the message tracking log on the screen or get them in a file form to use later.
According to Microsoft resources, it is possible to write the results to a file by piping the output to ConvertTo-Html or ConvertTo-Csv and adding > <filename> to the command.
In this case, the command would look like this:
In this example, this command retrieves message tracking log data for the specified server, date range, and sender, and then it pipes the output to the ConvertTo-Html cmdlet. The results are saved to an HTML file located at “C:\My Documents\message track.html.”
Bulk export all mailboxes to CSV file
We will bulk export all the Exchange Online mailboxes to a CSV file. After that, we can open it with Microsoft Excel.
Run the below PowerShell command.
Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName, Alias, Identity, RecipientTypeDetails | Export-Csv "C:\temp\AllMailboxes.csv" -Encoding UTF8 -NoTypeInformationFormat Get-Mailbox output for all mailboxes
We want to optimize the output displayed by the Get-mailbox command.
There are a few things with problems:
- Using the Format-Table (ft) displays very limited information, whereas the Format-List (fl) displays too much information, which is not easy to read.
- The PowerShell console screen has a specific width for each header, which leads to a limited amount of data displayed.
We will show you different solutions to find or filter the mailboxes.
Using the Property option
It will automatically override the default properties displayed by the Get-Mailbox command.
See the PowerShell syntax example.
Get-Mailbox -ResultSize Unlimited | Format-Table -Property Alias, Displayname, EmailAddressesYou can use a shortened version without specifying the -Property option. When you use the option Format-Table, you can use the abbreviation ft, and for Format-List, you can use the abbreviation fl.
Run the below PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Format-Table Alias, Displayname, EmailAddressesSee the PowerShell output results.
Alias DisplayName EmailAddresses
----- ----------- --------------
Amanda.Hansen Amanda Hansen {SIP:amanda.hansen@m365info.com, SPO:SPO_a21d1f73-5b3e-47db-bccd-16559e7d5560@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd, SMTP:Amanda.…
Anna.Bell Anna Bell {SIP:anna.bell@m365info.com, SMTP:Anna.Bell@m365info.com, smtp:Anna.Bell@ms365info.onmicrosoft.com}
Anne.Butler Anne Butler {SIP:anne.butler@m365info.com, SMTP:Anne.Butler@m365info.com}
Brenda.Smith Brenda Smith {SIP:brenda.smith@m365info.com, SMTP:Brenda.Smith@m365info.com, smtp:Brenda.Smith@ms365info.onmicrosoft.com}
Brian.Mill Brian Mill {SIP:brian.mill@m365info.com, SMTP:Brian.Mill@m365info.com}
Carl.Hawk Carl Hawk {SIP:carl.hawk@m365info.com, SMTP:Carl.Hawk@m365info.com, smtp:Carl.Hawk@ms365info.onmicrosoft.com}
Catch.All Catch All {smtp:Catch.All@ms365info.onmicrosoft.com, SMTP:Catch.All@m365info.com}
Charles.Mitchel Charles Mitchel {SMTP:Charles.Mitchel@m365info.com, smtp:Charles.MitchelNEW@m365info.com}
Diana.Baker Diana Baker {SMTP:Diana.Baker@m365info.com, SPO:SPO_13fee752-5966-4b62-98e2-f27fe9e5f66d@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd}It shows all the properties you provided, but some values are too long for the limited PowerShell console output width.
A solution to the limited width of the values output could be using the Format-List (fl) with the same PowerShell command.
Run the below PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Format-List Alias, Displayname, EmailAddressesSee the PowerShell output result.
Alias : Amanda.Hansen
DisplayName : Amanda Hansen
EmailAddresses : {SIP:amanda.hansen@m365info.com, SPO:SPO_a21d1f73-5b3e-47db-bccd-16559e7d5560@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd, SMTP:Amanda.Hansen@m365info.com}
Alias : Anna.Bell
DisplayName : Anna Bell
EmailAddresses : {SIP:anna.bell@m365info.com, SMTP:Anna.Bell@m365info.com, smtp:Anna.Bell@ms365info.onmicrosoft.com}
Alias : Anne.Butler
DisplayName : Anne Butler
EmailAddresses : {SIP:anne.butler@m365info.com, SMTP:Anne.Butler@m365info.com}
Alias : Brenda.Smith
DisplayName : Brenda Smith
EmailAddresses : {SIP:brenda.smith@m365info.com, SMTP:Brenda.Smith@m365info.com, smtp:Brenda.Smith@ms365info.onmicrosoft.com}
Alias : Brian.Mill
DisplayName : Brian Mill
EmailAddresses : {SIP:brian.mill@m365info.com, SMTP:Brian.Mill@m365info.com}
Alias : Carl.Hawk
DisplayName : Carl Hawk
EmailAddresses : {SIP:carl.hawk@m365info.com, SMTP:Carl.Hawk@m365info.com, smtp:Carl.Hawk@ms365info.onmicrosoft.com}
Alias : Catch.All
DisplayName : Catch All
EmailAddresses : {smtp:Catch.All@ms365info.onmicrosoft.com, SMTP:Catch.All@m365info.com}
Alias : Charles.Mitchel
DisplayName : Charles Mitchel
EmailAddresses : {SMTP:Charles.Mitchel@m365info.com, smtp:Charles.MitchelNEW@m365info.com}
Alias : Diana.Baker
DisplayName : Diana Baker
EmailAddresses : {SMTP:Diana.Baker@m365info.com, SPO:SPO_13fee752-5966-4b62-98e2-f27fe9e5f66d@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd}View mailbox statistics
You can also show the mailbox and folder size information of a single or all mailboxes.
Run the below PowerShell command to show information for a single mailbox.
Get-Mailbox "Amanda.Hansen@m365info.com" | Get-MailboxStatistics | Format-List DisplayName, StorageLimitStatus, TotalItemSize, TotalDeletedItemSize, ItemCount, DeletedItemCountThe PowerShell output shows the mailbox statistics of a single mailbox.
DisplayName : Amanda Hansen
StorageLimitStatus :
TotalItemSize : 28.66 MB (30,056,815 bytes)
TotalDeletedItemSize : 4.378 MB (4,590,806 bytes)
ItemCount : 766
DeletedItemCount : 801Run the below PowerShell command to show information for all mailbox sizes.
Get-Mailbox -ResultSize Unlimited | Get-MailboxStatistics | Format-List DisplayName, StorageLimitStatus, TotalItemSize, TotalDeletedItemSize, ItemCount, DeletedItemCountView mailbox quota size
Run the below PowerShell command to show quotas assigned to a single mailbox.
Get-Mailbox "Amanda.Hansen@m365info.com" | Format-List *QuotaIt shows the below PowerShell output.
ProhibitSendQuota : 99 GB (106,300,440,576 bytes)
ProhibitSendReceiveQuota : 100 GB (107,374,182,400 bytes)
RecoverableItemsQuota : 30 GB (32,212,254,720 bytes)
RecoverableItemsWarningQuota : 20 GB (21,474,836,480 bytes)
CalendarLoggingQuota : 6 GB (6,442,450,944 bytes)
IssueWarningQuota : 98 GB (105,226,698,752 bytes)
RulesQuota : 256 KB (262,144 bytes)
ArchiveQuota : 100 GB (107,374,182,400 bytes)
ArchiveWarningQuota : 90 GB (96,636,764,160 bytes)Run the below PowerShell command to show quotas assigned to all mailboxes.
Get-Mailbox -ResultSize Unlimited | Format-List DisplayName, Alias, *QuotaUsing the Wrap option
Another solution to view the long values in the PowerShell output is to use the -Wrap option.
The properties, such as Email addresses that include long values and reach the PowerShell console width limitation will be moved to the next line. In this case, we can see the entire value of the email addresses.
Run the PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Format-Table Alias, Displayname, EmailAddresses -WrapSee the PowerShell output results.
Alias DisplayName EmailAddresses
----- ----------- --------------
Amanda.Hansen Amanda Hansen {SIP:amanda.hansen@m365info.com, SPO:SPO_a21d1f73-5b3e-47db-bccd-16559e7d5560@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd, SMTP:Amanda.Hansen@m365info.com}
Anna.Bell Anna Bell {SIP:anna.bell@m365info.com, SMTP:Anna.Bell@m365info.com, smtp:Anna.Bell@ms365info.onmicrosoft.com}
Anne.Butler Anne Butler {SIP:anne.butler@m365info.com, SMTP:Anne.Butler@m365info.com}
Brenda.Smith Brenda Smith {SIP:brenda.smith@m365info.com, SMTP:Brenda.Smith@m365info.com, smtp:Brenda.Smith@ms365info.onmicrosoft.com}
Brian.Mill Brian Mill {SIP:brian.mill@m365info.com, SMTP:Brian.Mill@m365info.com}
Carl.Hawk Carl Hawk {SIP:carl.hawk@m365info.com, SMTP:Carl.Hawk@m365info.com, smtp:Carl.Hawk@ms365info.onmicrosoft.com}
Catch.All Catch All {smtp:Catch.All@ms365info.onmicrosoft.com, SMTP:Catch.All@m365info.com}
Charles.Mitchel Charles Mitchel {SMTP:Charles.Mitchel@m365info.com, smtp:Charles.MitchelNEW@m365info.com}
Diana.Baker Diana Baker {SMTP:Diana.Baker@m365info.com, SPO:SPO_13fee752-5966-4b62-98e2-f27fe9e5f66d@SPO_a2ff010e-0e03-4c56-8863-2ae7f07876dd}It shows the rest of the Email Addresses displayed on the next line.
Using the Group option
When we use the Get-Mailbox command, the result includes a list of all the mailbox types, such as:
The Group option enables you to group the output results. When you use the Group option, you must specify the properties that will serve as the source for the grouping.
In our example, we want to group the information according to the mailbox type, so we will use the property RecipientTypeDetails.
Run the PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Group RecipientTypeDetailsThe PowerShell output result is shown below.
Count Name Group
----- ---- ----- 1 DiscoveryMailbox {Discovery Search Mailbox} 2 EquipmentMailbox {Projector 21, Projector 8} 1 RoomMailbox {RoomTest8} 2 SharedMailbox {Catch All, Info Box} 19 UserMailbox {Amanda Hansen, Anna Bell, Anne Butler, Brenda Smith…}It shows the number of all the different mailbox types you have and groups the names together.
Using the Sort option
Using the Sort option, you can sort the output by relating it to a specific property header. The values for the header will be sorted ascending by default. If you want to use descending sorting, you need to specify that.
- Name
- DisplayName
- Alias
- Office
- ServerLegacyDN
In our example, we want to sort the output of the Get-Mailbox command by the property Alias.
See the PowerShell command syntax.
Get-Mailbox -ResultSize Unlimited | Sort AliasRun the below PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Sort Alias -DescendingThe PowerShell output result.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
fd199cb4-2ebf-4171-96e2-… Susan.Brown EURPR02DG429-db133 99 GB (106,300,440,… fd199cb4-2ebf-4171-96e2-12fd75453e39
c32b2b27-d809-439a-a3e3-… Stephen.Hunter EURPR02DG597-db438 99 GB (106,300,440,… c32b2b27-d809-439a-a3e3-eb7a749eeb72
1e367b85-f0c0-4c9c-a16a-… Soren.Vest EURPR02DG387-db004 99 GB (106,300,440,… 1e367b85-f0c0-4c9c-a16a-22d132f1d8e6
e5c3a5e8-eeae-4829-94dc-… Ryan.Walker EURPR02DG514-db387 99 GB (106,300,440,… e5c3a5e8-eeae-4829-94dc-fb7228bcf8da
RoomTest8 RoomTest8 EURPR02DG611-db195 99 GB (106,300,440,… 274d72d7-cc30-4a64-bc33-c99ff96c3abf
85df102b-1330-4359-8e6b-… Rene.Gibs EURPR02DG489-db525 99 GB (106,300,440,… 85df102b-1330-4359-8e6b-240677b26454
Projector 8 Projector8 EURPR02DG512-db190 49.5 GB (53,150,220… 3c06bdad-3224-4b93-ac4e-fb7dcd23e0ce
Projector 21 Projector21 EURPR02DG597-db175 49.5 GB (53,150,220… 6f4d2832-2753-4433-aba9-11dd73c14e39
3bb176aa-d0ba-47f7-aecc-… Mary.James EURPR02DG233-db100 99 GB (106,300,440,… 3bb176aa-d0ba-47f7-aecc-f4837593006e
213a5a8b-0bcf-40cc-b114-… Laura.Terry EURPR02DG117-db074 99 GB (106,300,440,… 213a5a8b-0bcf-40cc-b114-edb1b2a423f4
12eefbb2-e5f4-4eec-bd18-… Ken.Walker EURPR02DG393-db032 99 GB (106,300,440,… 12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b
33a56fba-ed21-456d-90be-… Justin.Russel EURPR02DG387-db166 99 GB (106,300,440,… 33a56fba-ed21-456d-90be-ade268b9acc8The PowerShell output is sorted by the Alias in descending order, meaning the last letters in the alphabet will come first in line.
Using the AutoSize option
The Autosize option is relevant when we choose to display information using Format-Table. When you use the ft option, the PowerShell output uses a predefined table row width.
The PowerShell console is not wide enough to display all the properties if you don’t open it in full screen. Because of the width limitation, PowerShell removes the other last default properties from the display, such as Database, ProhibitSendQuota, and ExternalDirectoryObjectId.
You can avoid this using the -Autosize parameter because PowerShell will customize the table row width to fit the values under the table headers.
Run the below PowerShell command example.
Get-Mailbox -ResultSize Unlimited | Format-Table -AutosizeSee the PowerShell output result.
Name Alias Database ProhibitSendQuota ExternalDirectoryObjectId
---- ----- -------- ----------------- -------------------------
41377e9c-dc47-46c0-b4a5-1d5bbdcb5cc5 Amanda.Hansen EURPR02DG549-db028 99 GB (106,300,440,576 bytes) 41377e9c-dc47-46c0-b4a5-1d5bbdcb5cc5
82cd0d62-e974-4892-aca6-e0387abc62be Anna.Bell EURPR02DG037-db046 99 GB (106,300,440,576 bytes) 82cd0d62-e974-4892-aca6-e0387abc62be
5cae3874-442b-459c-8f33-3aee5b879275 Anne.Butler EURPR02DG275-db096 99 GB (106,300,440,576 bytes) 5cae3874-442b-459c-8f33-3aee5b879275
0f38d53f-cbe0-4844-86e9-1032a45ba31b Brenda.Smith EURPR02DG598-db076 99 GB (106,300,440,576 bytes) 0f38d53f-cbe0-4844-86e9-1032a45ba31b
411a8f10-0dfa-4034-a1e3-a8b6e4cad2f6 Brian.Mill EURPR02DG558-db051 99 GB (106,300,440,576 bytes) 411a8f10-0dfa-4034-a1e3-a8b6e4cad2f6
52a6c1c7-77d2-4109-99b9-a4076167b6e2 Carl.Hawk EURPR02DG234-db124 99 GB (106,300,440,576 bytes) 52a6c1c7-77d2-4109-99b9-a4076167b6e2
Catch All Catch.All EURPR02DG588-db346 49.5 GB (53,150,220,288 bytes) 182292ee-eaec-438b-bf14-f25dec9cf1cd
d5dc703a-45d0-4dc3-89ba-16f088925e41 Charles.Mitchel EURPR02DG517-db333 99 GB (106,300,440,576 bytes) d5dc703a-45d0-4dc3-89ba-16f088925e41
b602b148-2fcf-435a-9d34-ce72c3a8c748 Diana.Baker EURPR02DG060-db131 99 GB (106,300,440,576 bytes) b602b148-2fcf-435a-9d34-ce72c3a8c748
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} EURPR02DG219-db026 50 GB (53,687,091,200 bytes)It shows the entire output result for all the properties of each mailbox.
Combination of display parameters
- Sort
- Format-Table
- Group
PowerShell command syntax:
Get-Mailbox -ResultSize Unlimited | Sort RecipientTypeDetails | Format-Table Name, Alias -Group RecipientTypeDetails- First, it will get all the existing mailboxes in Exchange Online.
- Then, it will Sort the mailboxes using the RecipientTypeDetails property.
- We also use the Format-Table (ft) and only want to display the Alias and the Name properties.
- Lastly, the option Group will display the information in sections according to the mailbox types.
See the PowerShell output result.
RecipientTypeDetails: DiscoveryMailbox
Name Alias
---- -----
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} RecipientTypeDetails: EquipmentMailbox
Name Alias
---- -----
Projector 8 Projector8
Projector 21 Projector21 RecipientTypeDetails: RoomMailbox
Name Alias
---- -----
RoomTest8 RoomTest8 RecipientTypeDetails: SharedMailbox
Name Alias
---- -----
Catch All Catch.All
Info Box InfoBox RecipientTypeDetails: UserMailbox
Name Alias
---- -----
41377e9c-dc47-46c0-b4a5-1d5bbdcb5cc5 Amanda.Hansen
1e367b85-f0c0-4c9c-a16a-22d132f1d8e6 Soren.Vest
e5c3a5e8-eeae-4829-94dc-fb7228bcf8da Ryan.Walker
85df102b-1330-4359-8e6b-240677b26454 Rene.Gibs
3bb176aa-d0ba-47f7-aecc-f4837593006e Mary.James
213a5a8b-0bcf-40cc-b114-edb1b2a423f4 Laura.Terry
12eefbb2-e5f4-4eec-bd18-df7ca2f1ee6b Ken.Walker
2ab57f6a-6824-40a3-8fb0-d4357e8b91b1 John.Doe2
c32b2b27-d809-439a-a3e3-eb7a749eeb72 Stephen.Hunter
29a12fd8-bbd2-440f-b457-8e304200a85d Frank.Olsen
b602b148-2fcf-435a-9d34-ce72c3a8c748 Diana.Baker
d5dc703a-45d0-4dc3-89ba-16f088925e41 Charles.Mitchel
52a6c1c7-77d2-4109-99b9-a4076167b6e2 Carl.Hawk
411a8f10-0dfa-4034-a1e3-a8b6e4cad2f6 Brian.Mill
0f38d53f-cbe0-4844-86e9-1032a45ba31b Brenda.Smith
5cae3874-442b-459c-8f33-3aee5b879275 Anne.Butler
82cd0d62-e974-4892-aca6-e0387abc62be Anna.Bell
33a56fba-ed21-456d-90be-ade268b9acc8 Justin.Russel
fd199cb4-2ebf-4171-96e2-12fd75453e39 Susan.BrownInterpreting Objects
Once you’ve found some objects, the next step is to make sense of the data. Most PowerShell cmdlets return easy-to-use properties, but there are a few things to watch out for with some Microsoft 365 cmdlets.
In some cases, the value returned for a property is an array and some work is needed to get the full information that you might want. Consider this example of finding who manages a distribution list:
Get-DistributionGroup -Identity VIPusers | Format-List ManagedBy
ManagedBy : {tony.redmond, Lotte.Vetler, d36b323a-32c3-4ca5-a4a5-2f7b4fbef31c}The ManagedBy property holds the name of each owner account. To get more information about the owners, use the names with another cmdlet like Get-ExoMailbox. For example:
[array]$ManagedBy = Get-DistributionGroup -Identity VIPUsers | Select-Object -ExpandProperty ManagedBy $ManagedBy | Get-ExoMailbox | Format-Table DisplayName, Alias, Name DisplayName Alias Name ----------- ----- ---- Tony Redmond Tony.Redmond tony.redmond Lotte Vetler Lotte.Vetler Lotte.Vetler Kim Akers (She/Her) Kim.Akers d36b323a-32c3-4ca5-a4a5-2f7b4fbef31c
Some of the Microsoft Graph PowerShell SDK cmdlets obscure valuable information. For example, the Get-MgGroupMember cmdlet returns a list of account identifiers for group members:
Get-MgGroupMember -GroupId (Get-MgGroup -Filter "Displayname eq 'System Innovation'").Id Id DeletedDateTime -- --------------- eff4cd58-1bb8-4899-94de-795f656b4a18 a3eeaea5-409f-4b89-b039-1bb68276e97d 67105a51-e817-493e-8094-f600babf5f62 d36b323a-32c3-4ca5-a4a5-2f7b4fbef31c
If you want details of the group members, a different approach is necessary to retrieve the information from the additionalProperties property:
$GroupId = (Get-MgGroup -Filter "displayName eq 'System Innovation'").Id
Get-MgGroupMember -GroupId $GroupId | Select-Object -ExpandProperty additionalProperties
Key Value
--- -----
@odata.type #microsoft.graph.user
businessPhones {+1 713 633-5141}
displayName Kim Akers (She/Her)
givenName Kim
jobTitle VP Marketing
mail Kim.Akers@office365itpros.com
mobilePhone +1 761 504-0011
officeLocation NYC
preferredLanguage en-US
surname Akers
userPrincipalName Kim.Akers@office365itpros.comBefore you ask, it’s the Graph that returns data in this way.
The unified audit log is a great source of valuable information about who did what and when inside a Microsoft 365 tenant. Workloads capture audit events as people interact with applications and those events eventually end up in the audit log. The Search-UnifiedAuditLog cmdlet (which has had some recent problems) finds data from the log. A lot of interesting detail is contained in a JSON-format property called AuditData. Before you can extract information from that property, you must convert it from JSON.
$Records = search-UnifiedAuditLog -StartDate 18-Oct-2023 -EndDate 19-Oct-2023 -Operations FileModified -Formatted -ResultSize 5000 -SessionCommand ReturnLargeSet
After finding the right event, we can convert its AuditData property:
$AuditData = $Records[0].AuditData | ConvertFrom-Json
And then all the fields in the property are available for use in a script. For instance, here’s the site URL for the modified document:
$AuditData.SiteUrl https://office365itpros.sharepoint.com/sites/BlogsAndProjects/
At this point, you might wonder how to deal with all of the edge cases you might encounter. Trial and error and good internet searches are the normal response. Someone has probably met and overcome a problem you meet, and maybe there’s a Practical365.com article that helps. Just be persistent.

Using Get-MessageTrackingLog in PowerShell
Now that you are familiar with Get-MessageTrackingLog’s syntax, key parameters, and practical applications, it’s time to use this command at your will. However, before you do so, check out these three key findings:
- Get-MessageTrackingLog retrieves useful email tracking information contained in the logs of different Exchange Server environments;
- For the Get-MessageTrackingLog to return the desired information, it is necessary to modify the cmdlet parameters to match your needs;
- Keep in mind that Get-MessageTrackingLog and Get-MessageTrace are not the same thing – they are two different commands with similar purposes, each of them with its advantages.
Get-MessageTrackingLog Syntax & Meaning
- DomainController <Fqdn>: Specifies the fully qualified domain name (FQDN) of the domain controller to be used for the query;
- End <DateTime>: Specifies the end date and time for the message tracking log query, indicating the upper limit for the time range of messages to be included in the results;
- EventId <String>: Filters messages based on the event ID, allowing you to focus on messages with specific events;
- InternalMessageId <String>: Specifies the internal message ID, allowing you to retrieve details about a specific email message;
- MessageId <String>: Allows you to specify one or more message IDs to retrieve details about specific email messages;
- MessageSubject <String>: Filters messages based on the subject of the email;
- Recipients <String>: Filters messages based on the email addresses of the recipients;
- Reference <String>: Specifies a reference string for filtering messages;
- ResultSize <Unlimited>: Specifies the maximum number of results to be returned by the query. The default is unlimited;
- Sender <String>: Filters messages based on the email address of the sender;
- Server <ServerIdParameter>: Specifies the server to be queried for the message tracking log;
- Start <DateTime>: Specifies the start date and time for the message tracking log query, indicating the lower limit for the time range of messages to be included in the results;
- NetworkMessageId <String>: Specifies the network message ID, allowing you to retrieve details about a specific email message;
- Source <String>: Filters messages based on the message source, such as SMTP or STOREDRIVER;
- TransportTrafficType <String>: Filters messages based on the transport traffic type, such as “Receive” or “Send.”
Getting Objects
All the Microsoft 365 modules are well-equipped with cmdlets to fetch objects. Sometimes multiple cmdlets exist that can fetch the same objects, meaning that the trick is to make the right choice of which cmdlet to use. That decision depends on the context. We’ll get to that later.
Table 1 lists some of the basic objects used in Microsoft 365 and the cmdlets available to fetch these objects.
| Object type | Cmdlets | Module |
| User accounts | Get-MgUser | Microsoft Graph PowerShell SDK |
| Mailboxes | Get-Mailbox and Get-ExoMailbox | Exchange Online management |
| SharePoint Online sites | Get-SPOSite Get-MgSite | SharePoint Online management Microsoft Graph PowerShell SDK |
| OneDrive for Business accounts | Get-SPOSite Get-MgSite | SharePoint Online management Microsoft Graph PowerShell SDK |
| Microsoft 365 Groups | Get-UnifiedGroup Get-MgGroup | Exchange Online management Microsoft Graph PowerShell SDK |
| Teams | Get-Team Get-MgTeam | Microsoft Teams Microsoft Graph PowerShell SDK |
| Devices | Get-MgDevice | Microsoft Graph PowerShell SDK |

