Fetch User Mailbox Activity Using Graph PowerShell

Monitoring mailbox activity is a vital part of Microsoft 365 administration. Whether you're auditing inactive users or analysing mailbox usage trends, PowerShell—combined with Microsoft Graph—offers a powerful approach.
In this article, we’ll walk you through how to retrieve user mailbox activity using the Get-MgReportMailboxUsageDetail cmdlet from the Microsoft Graph PowerShell module.

The Script

# Connect to Microsoft Graph with Reports.Read.All permission
Connect-MgGraph -Scopes "Reports.Read.All"
                                
# Fetch mailbox usage details for the last 30 days (maximum retention: 180 days)
$response = Get-MgReportMailboxUsageDetail -Period "D30"
                                
# Display mailbox activity
if ($response.Count -eq 0) {
    Write-Host "No mailbox data available for the selected period." -ForegroundColor Yellow
} else {
$response | Select-Object `
    @{Name = "Display Name"; Expression = { $_.DisplayName }},
    @{Name = "User Principal Name"; Expression = { $_.UserPrincipalName }},
    @{Name = "Is Licensed"; Expression = { if ($_.IsLicensed -eq $true) { "Licensed" } else { "Unlicensed" } }},
    @{Name = "Last Activity Date"; Expression = { $_.LastActivityDate }},
    @{Name = "Mailbox Size (MB)"; Expression = { $_.StorageUsedInMB }} |
    Format-Table -AutoSize
}
                            

How the Script Works

• Connect-MgGraph: Establishes a secure connection with the Graph API using the necessary Reports.Read.All permission.
• Get-MgReportMailboxUsageDetail: Pulls mailbox activity data for the past 30 days (-Period "D30").
• Select-Object: Extracts key fields like display name, UPN, license status, last activity date, and mailbox size.
• Format-Table: Displays the information cleanly in tabular form for easy reading.

Further Enhancements

Here are a few ideas to expand this script:

• 🔍 Filter for Inactive Users: Filter for users with blank or older LastActivityDate values.
• 📤 Export to CSV: Pipe the result to Export-Csv for record-keeping or auditing.
• 📊 Visual Reports: Feed data into Power BI or Excel dashboards.
• 🕒 Historical Comparisons: Compare mailbox size or activity changes over different 30-day periods.

📌 Note: How to Show Real UserPrincipalNames

If you see placeholder values or anonymized data (like numeric strings) in the UserPrincipalName field, you need to disable privacy settings in the Microsoft 365 Admin Center:

1. Go to https://admin.microsoft.com.
2. Navigate to Settings > Org Settings.
3. Select Reports, select Display concealed user, group and site names in all reports.
4. Save changes.

🔁 You may need to wait up to 24 hours for changes to reflect in usage reports.

Use Cases

• 🔒 Identify Inactive Mailboxes: Spot users who haven’t accessed their mailbox recently.
• 🧹 Clean-Up Unused Accounts: Remove licenses from inactive users.
• 📊 License Optimization: Analyze mailbox size vs license type.
• 📁 Compliance Checks: Ensure users are actively accessing sensitive mailboxes.

Frequently Asked Questions

• What permissions are required to use Get-MgReportMailboxUsageDetail?

You’ll need the Reports.Read.All or Reports.ReadWrite.All permission in Microsoft Graph. These can be granted either through delegated or application permissions depending on your access model.

• Why do I get an empty report even though mailboxes are active?

The mailbox activity reports depend on the Microsoft 365 reporting data refresh cycle. If users haven’t accessed their mailboxes during the specified period, the data may appear empty. Try expanding the report period to D30 or D90.

• Can I automate mailbox usage reporting?

Yes. You can schedule a PowerShell script that runs the Get-MgReportMailboxUsageDetail cmdlet daily or weekly and exports results to a CSV for automated reporting and trend tracking.

• What is the maximum period supported for fetching mailbox activity data?

The Period parameter supports a maximum of 180 days (D180). Any request beyond that limit will return an error.

Possible Errors & Solutions

Get-MgReportMailboxUsageDetail -Period D30 -OutFile "C:\Reports\MailboxUsage.csv"

Conclusion

The Get-MgReportMailboxUsageDetail cmdlet is a reliable way to monitor mailbox activity across your Microsoft 365 environment. With just a few lines of code, administrators can generate useful reports, identify inactive mailboxes, and ensure efficient use of licenses. As Microsoft Graph evolves, keep an eye out for more flexible reporting endpoints that may allow direct querying and filtering in JSON.