Fetch User Mailbox Activity Using Graph PowerShell

Monitoring mailbox activity is a vital part of Microsoft 365 administration. Whether you're auditing inactive users or analysing mailbox usage trends, PowerShell—combined with Microsoft Graph—offers a powerful approach.
In this article, we’ll walk you through how to retrieve user mailbox activity using the Get-MgReportMailboxUsageDetail cmdlet from the Microsoft Graph PowerShell module.

The Script

# Connect to Microsoft Graph with Reports.Read.All permission
Connect-MgGraph -Scopes "Reports.Read.All"
                                
# Fetch mailbox usage details for the last 30 days (maximum retention: 180 days)
$response = Get-MgReportMailboxUsageDetail -Period "D30"
                                
# Display mailbox activity
if ($response.Count -eq 0) {
    Write-Host "No mailbox data available for the selected period." -ForegroundColor Yellow
} else {
$response | Select-Object `
    @{Name = "Display Name"; Expression = { $_.DisplayName }},
    @{Name = "User Principal Name"; Expression = { $_.UserPrincipalName }},
    @{Name = "Is Licensed"; Expression = { if ($_.IsLicensed -eq $true) { "Licensed" } else { "Unlicensed" } }},
    @{Name = "Last Activity Date"; Expression = { $_.LastActivityDate }},
    @{Name = "Mailbox Size (MB)"; Expression = { $_.StorageUsedInMB }} |
    Format-Table -AutoSize
}
                            

How the Script Works

• Connect-MgGraph: Establishes a secure connection with the Graph API using the necessary Reports.Read.All permission.
• Get-MgReportMailboxUsageDetail: Pulls mailbox activity data for the past 30 days (-Period "D30").
• Select-Object: Extracts key fields like display name, UPN, license status, last activity date, and mailbox size.
• Format-Table: Displays the information cleanly in tabular form for easy reading.

Further Enhancements

Here are a few ideas to expand this script:

• 🔍 Filter for Inactive Users: Filter for users with blank or older LastActivityDate values.
• 📤 Export to CSV: Pipe the result to Export-Csv for record-keeping or auditing.
• 📊 Visual Reports: Feed data into Power BI or Excel dashboards.
• 🕒 Historical Comparisons: Compare mailbox size or activity changes over different 30-day periods.

📌 Note: How to Show Real UserPrincipalNames

If you see placeholder values or anonymized data (like numeric strings) in the UserPrincipalName field, you need to disable privacy settings in the Microsoft 365 Admin Center:

1. Go to https://admin.microsoft.com.
2. Navigate to Settings > Org Settings.
3. Select Reports, select Display concealed user, group and site names in all reports.
4. Save changes.

🔁 You may need to wait up to 24 hours for changes to reflect in usage reports.

Use Cases

• 🔒 Identify Inactive Mailboxes: Spot users who haven’t accessed their mailbox recently.
• 🧹 Clean-Up Unused Accounts: Remove licenses from inactive users.
• 📊 License Optimization: Analyze mailbox size vs license type.
• 📁 Compliance Checks: Ensure users are actively accessing sensitive mailboxes.

Possible Errors & Solutions

Error	Cause	Solution
Access Denied	Missing Graph permissions	Use Connect-MgGraph -Scopes "Reports.Read.All"
Blank UserPrincipalName	Privacy settings enabled	See the note above to show real UPNs
The term 'Get-MgReportMailboxUsageDetail' is not recognized	Module not installed or outdated	Run Install-Module Microsoft.Graph.Reports

Conclusion

The Get-MgReportMailboxUsageDetail cmdlet is a reliable way to monitor mailbox activity across your Microsoft 365 environment. With just a few lines of code, administrators can generate useful reports, identify inactive mailboxes, and ensure efficient use of licenses. As Microsoft Graph evolves, keep an eye out for more flexible reporting endpoints that may allow direct querying and filtering in JSON.