Use PowerShell for view Exchange Online objects | Part 3#3 5/5 (2) 39 min read

My primary goal in the current articles is to review the way that we use PowerShell as a tool for implementing “filtered search” in the Exchange Online based environment.

In some scenarios, we can use built PowerShell cmdlets, that enable us to query Exchange Online about a specific type of recipients.
The main option that we review in this article for implementing filtered search query is the PowerShell statement “Where.”

Use PowerShell for view Office 365 and Exchange Online objects | Article Table of content

The term “specific Exchange Online objects” can be translated to many types of scenarios.

For example

  • Example 1 – creating a PowerShell “Filtered search,” looking for a specific type of Online recipients such as – mail contacts, Exchange Groups, Public Folder, mailbox users and so on.
  • Example 2 – creating a PowerShell “Filtered search,” looking for Exchange Online mailboxes that their E-mail address includes the specific domain name or specific Alias.
  • Example 3 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox type such as – User mailbox, Shared mailbox, Room Mailbox and so on.
  • Example 4 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox such as – mailboxes with an archive, mailboxes with Litigation Hold, mailboxes with In-Place Hold, mailboxes with Audit enabled; Soft deleted Exchange Online mailbox, Inactive Exchange Online mailboxes and so on.
  • Example 5 – creating a PowerShell “Filtered search,” looking for a “property” of the Exchange Online mailbox user such as – user from a specific department, a user with a specific title, specific state or Province and so on.
  • Example 6 – creating a PowerShell “Filtered search,” looking for an Exchange mailboxes “Date information.” For example:
    • Exchange Online mailboxes that were created at a specific time (minutes, days, mount and year).
    • Exchange Online mailboxes that were accessed by a user (mailbox owner) on a specific time (minutes, days, mount and year).


Display information about Exchange mailboxes using the Get-Mailbox command

View all Exchange Online mailboxes versus a default limited number

Exchange includes many types of mailboxes such as a user mailbox, shared mailbox, room mailbox and so on. By using the PowerShell command – Get-Mailbox, we ask to display all the types of Exchange mailboxes.

By default, the results from the PowerShell command Get-Mailbox display only the “first 1,000 Exchange mailboxes.”

Display information about all the different type of Exchange Online mailboxes | No “limit” of the Exchange Online mailboxes number that will be displayed.

In case that we want to “extend” the default “1,000 result restriction” or to accurately indicate the Exchange Online mailboxes number that we want to display, we can use the parameter ResultSize.

The ResultSize parameter, specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter.

How to know which filter parameter I can use when I address Exchange Online mailbox object?

In the following article, we review different examples in which we create a Filtered search, looking for a specific property of Exchange Online mailbox.

In case that we want to get a list of all the available properties of a specific PowerShell object such as “Exchange Online mailbox,” we can use the PowerShell cmdlets – Get-Member

For example, to get a list of the properties (members) of the PowerShell command-
Get-Mailbox that we can “query,” we can use the PowerShell command Get-Member.

An example of the PowerShell syntax that we use is:

Get information about PowerShell object properties

PowerShell command syntax

PowerShell console output example

Two useful PowerShell parameter that we can use | Count + Group-Object

In the following section, I would like to briefly review two useful PowerShell option that can be applied to the “results” that we get from the PowerShell command output.

Count the number of Exchange Online mailboxes

The PowerShell “count” option, enable us to “count” the results that are displayed by the PowerShell command.

In the following example, we use the PowerShell parameter “count” for counting the number of Exchange Online mailboxes that are “created” when
we use the PowerShell command- Get-Mailbox.

Count the number of Exchange Online mailboxes

PowerShell command syntax

The PowerShell “Group-Object” option, enable us as the name suggests, the “Group” the results that are displayed by the PowerShell command.

In the following example, we ask to display information about all the existing type Public Folder Exchange Online mailbox, but in addition, we ask to – Group the result of the mailbox type.

Display information about all Exchange Online mailboxes | Group by the mailbox

PowerShell command syntax

PowerShell console output example


Display information about a specific type of Exchange mailboxes

Exchange Online provides various types of “mailboxes” such as User mailbox, Room mailbox, Shared mailbox and much more.

In the following section, we can see examples of using a PowerShell command which will Filter the search results” by displaying only a specific type of Exchange Online mailboxes.

Filter the search result | Display information only about Exchange Online mailboxes considered as “User mailbox.”

PowerShell command syntax

PowerShell console output example

Filter the search result | Display information only about Exchange Online mailboxes considered as “Room mailbox.”

PowerShell command syntax

Filter the search result | Display information only about Exchange Online mailboxes considered as “Shared mailbox.”

PowerShell command syntax

Filter the search result | Display information only about Exchange Online mailboxes considered as “Equipment mailbox.”

PowerShell command syntax

Note – If you want to view the “full list” of the various types of Exchange Online mailboxes, you can use the following article – RecipientTypeDetails enumeration


Display information about a specific type of Exchange recipients

Exchange Online includes many types of “recipients.”

In the following section, we review the PowerShell commands, that will help us to “filter the search results” by looking for a specific Exchange Online recipient.

Display information about all Exchange Online recipients

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online contacts

PowerShell command syntax

Display information about all Exchange Online mail contacts

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online mail users

In Exchange Hybrid environment, the On-Premise Active Directory user account that have Exchange on-Premises mailbox will be considered as Get-Mailuser

Display information about all Exchange Online mail users

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online users

PowerShell command syntax

PowerShell console output example


Display information about Exchange Online groups

In this section, we review the PowerShell commands that we can use for – displaying information about the Exchange Online Group and specific group type such as – Security Group, Distribution Group and so on.

Display information about all the available Exchange Online group types

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online groups that considered as – Distribution groups

PowerShell command syntax

Display information about all Exchange Online dynamic distribution groups

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online groups that considered as – Unified groups

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online groups that considered as a “Security group.”

PowerShell command syntax

PowerShell console output example


Display information about Exchange Online Public Folders

In this section, we review the PowerShell commands that we can use for – displaying information Exchange Online Public Folders.

Display information about all Exchange Online Public Folders

The PowerShell command – Get-MailPublicFolder, display information only about “top level” Public Folder hierarchy.

PowerShell command syntax

PowerShell console output example

Display information about Exchange Online Public Folders + “child Public Folders”

If you want to display the “full Public Folder hierarchy” that includes top level Public Folder + “child Public Folders,” you can use the following PowerShell command:

PowerShell command syntax

PowerShell console output example

Additional reading


Display Exchange Online mailboxes, that have E-mail address with a specific Domain name suffix or Alias

Find and display Exchange Online mailboxes with an E-mail address that include a specific domain name.

Display all Exchange Online mailboxes which have an email with a specific domain name suffix.

In the following example, we look for Exchange Online mailboxes, with E-mail address that includes the domain name – o365info.com

PowerShell command syntax

PowerShell console output example

Find and display Exchange Online mailboxes, with an E-mail address that includes a specific Alias.

The exchange Online mailbox must have one E-mail address that defines as primary E-mail address buy can have an additional E-mail address which defines as – Proxy E-mail address.

When we look for a specific Alias (the “left part” of an E-mail address), we can define if we want to look for this alias only if the Alias appear on the primary E-mail address or look for an Alias that appear in all the Exchange Online Mailbox E-mail address.

Display all Exchange Online mailboxes which their primary E-mail address includes a specific alias

In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have a Primary E-mail address that includes the Alias name – Bob.

PowerShell command syntax

PowerShell console output example

Display all Exchange Online mailboxes, which their E-mail address includes a specific Alias

In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have E-mail address (any proxy E-mail address) that include the Alias name – Bob

PowerShell command syntax

PowerShell console output example


Display Exchange Online mailboxes - Soft Deleted mailboxes and Inactive mailboxes

In this section, we review how to use PowerShell commands that will restrict the search result only for Exchange Online mailboxes that considered as – Soft Deleted Exchange Online mailboxes or Inactive Exchange Online mailboxes.

Display information about all Exchange Online mailboxes that consider as – “Soft deleted mailboxes.”

PowerShell command syntax

PowerShell console output example

Display Exchange Online which their user account (owner) is disabled.

PowerShell command syntax

PowerShell console output example

Display information about all Exchange Online mailboxes that consider as – “Inactive mailboxes “.

PowerShell command syntax

PowerShell console output example


Display information about Exchange Online mailboxes that configured with a specific Time zone or specific language code

Display information about Exchange Online mailboxes | Specific time zone

In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition:

Display Exchange mailboxes with a specific time zone

In the following example, we want to get information about Exchange Online mailboxes that their time zone is = “Pacific Standard Time.”

PowerShell command syntax

PowerShell console output example

Note – when an OWA mail client selects this time zone, the time zone appears as – (GMT-08:00) Pacific Time (US and Canada).

Get a list of available Time Zones values

Tip – you can “fetch” information about values of Time Zones by using the following PowerShell command:

PowerShell console output example

You can read more information about the subject of – available values of “Time Zones,” in the following article: Microsoft Time Zone Index Values

Display information about Exchange Online mailboxes | Specific language

In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition:

Display information about Exchange Online mailboxes with a specific Language.

In the following example, we want to display Exchange mailboxes, that their language settings = “en-GB”.

PowerShell command syntax

PowerShell console output example


Display Exchange Online mailbox with Litigation hold or In-Place hold

In this section, we review the PowerShell commands that we can use for searching a specific Exchange Online mailbox, which configured as Exchange Online mailboxes with Litigation Hold or In-Place Hold.

Display information about Exchange Online mailboxes with Litigation Hold

PowerShell command syntax

PowerShell console output example

Display information about Exchange Online mailboxes with In-place Hold

PowerShell command syntax

PowerShell console output example

Display Exchange Online mailboxes with Audit enabled

Display Exchange Online mailboxes with Audit enabled

PowerShell command syntax

PowerShell console output example


Display information about Exchange Online mailboxes, which was configured to automatically forward E-mail to another E-mail address.

The “Forwarding option” can be configured to automatically forward each E-mail to another recipient in one of the following options:

Option 1 – Forwarding E-mail message to an internal recipient

A configuration in which the E-mail message, will automatically be forwarded to another “Office 365 recipients” (from the same Office 365 tenant).

This option defined by the PowerShell parameter – ForwardingAddress

Option 2 – Forwarding E-mail message to an external recipient

A configuration in which the E-mail message, will automatically be forwarded to another recipient who considered as “External recipient” meaning the recipient with the external email address.

This option defined by the PowerShell parameter – ForwardingSmtpAddress

Display Exchange Online mailboxes with E-mail forwarding enabled for an internal email address.

PowerShell command syntax

PowerShell console output example

Display Exchange Online mailboxes with E-mail forwarding enabled for an external email address.

PowerShell command syntax

PowerShell console output example


Display Exchange Online mailboxes, which doesn’t appear in the GAL

By default, each Exchange Online mailbox appears in the GAL (Global Address List).
In some case, specific Exchange Online mailboxes are configured to “not appear” (Mailboxes Hidden from Address Lists) in the GAL.

To be able to get a list of such Exchange Online mailboxes, we can use the following PowerShell command:

PowerShell command syntax

PowerShell console output example


Display Exchange Online mailboxes with Archive mailbox

Display Exchange Online mailboxes that have an Archive

PowerShell command syntax

PowerShell console output example

Display a list of Exchange Online mailboxes that doesn’t have an Archive.

We can use one of the following PowerShell command versions:

PowerShell command syntax

OR
PowerShell command syntax

PowerShell console output example


Display Exchange Online mailboxes | Filter the results by specific property or a combination of properties of the user (mailbox owner).

In the following section, we review how to filter the search result by using a specific “user property” such as Department, Title, State or Province and so on.

The PowerShell “object” that we refer is – not the Exchange Online mailbox, but instead, an object which described as “Exchange user object” (Get-User)

When using the Exchange Online web management interface, the user properties displayed as part of the Exchange Online mailbox properties.

Although the user properties are displayed as “part of the Exchange Online mailbox,” to be able to filter the search result, we need to address the “Exchange Online mailbox owner” meaning -the user who considers as the Exchange Online mailbox’s owner, and not the Exchange Online mailbox herself.

Display “Exchange Online user’s mailboxes,” with a specific “Department” value.

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department is – “Sales

PowerShell command syntax

PowerShell console output example

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department is – “Sales” or mailbox user department is – “Marketing.”

PowerShell command syntax

PowerShell console output example

Display “Exchange Online user’s mailboxes,” with a specific “Department” value and specific “Title” value

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user title is – “Manager.”
  • The user mailbox department is – “Sales

PowerShell command syntax

PowerShell console output example

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y + specific Title value

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user title is – “Manager.”
  • The user mailbox department is – “Sales” or user mailbox department is – “Marketing.”

PowerShell command syntax

PowerShell console output example

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department name start with a specific string

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department starts with the word – “Sales

In this example, the company have couple of department that start with the word “sales” such as: Sales, Sales USA etc.

PowerShell command syntax

PowerShell console output example

Display “Exchange Online user’s mailboxes,” that their Country or region is “not equal” to a specific Country or Region value.

This requirement sound a little bit confusing.
An example for such a requirement could be – a company with many sites all over the world.
The company needs to get a list of Exchange Online users, that are locate in the company branches around the world, besides the company branch in USA (not in USA).

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The user mailbox State Or Province is not USA

PowerShell command syntax

PowerShell console output example

Display Exchange Online mailboxes | Filter the results by “Date information.”

In the following section, we review how to create a PowerShell query, relate to the value of the “Date \ Time” of a specific object.

In our case, we are interested in getting information about Exchange Online mailboxes that have a specific property that has a specific value of “Date \ Time.”

I know that this definition seems a bit unclear, so we will provide more concrete examples in order as above.

Exchange Online mailbox object includes two “properties” that include a value of – “Date \ Time.”

  1. The first value is the “Date \ Time” in which the Exchange Online mailbox was created. This value defined as “WhenCreated.”
  2. The second value is – the “Date \ Time” in which the Exchange mailbox user (the mailbox owner) access (logged in) his Exchange Online mailbox. This value defined as “LastLogonTime.”

In the following section, I would like to start with an explanation of the way that we use PowerShell for implementing queries that relate to a “Date \ Time” value and then provide more specific examples of the PowerShell command syntax that we use for getting information about different “time frames” such as – Minutes, Hours, months, years and so on.

Using PowerShell for filter ?Time orientated events

Before we start with the information about the specific PowerShell command syntax, let’s spend a few moments on the concept of – using PowerShell for a query “event” that occurs in a specific time range.

To create the PowerShell “time-based query,” we will need to define the following parameters:

1. The object
The specific object that we ask to obtain information about him. The object can be “User account,” “Exchange mailbox” and so on.

2. The specific property of the object
For example, in an Office 365 environment, we can ask to get information about a specific time, in which Exchange Online mailbox was created.

In Office 365 the property that we “address” is – WhenCreated

3. The Time unit
PowerShell offers us a variety of “Time units” that we can use such as – Millisecond, Second, Minutes, Hour, Day, year and so on.

4. PowerShell operator
This is the specific PowerShell operator whom we use.

PowerShell query - Looking for information about an event which occur is a specific Point in time -01

Using the PowerShell operator with “Time ranges”

In our example, I will demonstrate various scenarios, using the following two PowerShell operators:

1. ge (Greater than or equal to).

Using the “ge” operator will help us to get information about an “event” that “happened” from a specific point in time and onwards.

2. le (Less than or equal to).

Using the “le” operator will help us to get information about an “event” that happened before a specific point in time.

PowerShell query - Looking for information about an event which occur is a specific Point in time -02

To be able to embody this concept, let’s use the following example:

The “starting point” is the PowerShell command – Get-Date, that “fetch” the current date (day, month, year and so on).

In our specific example, we want to define a “time range” of two months before the current date.

To define this time range, we use the following PowerShell command:

(Get-Date).AddMonths(-2)

We take the current date, and subtract from the current date “2 months.”

In our example, the “current time” is month 8 (August), and the day is “15.”

The result from the PowerShell command – (Get-Date).AddMonths(-2), will realize as a time range, which spans on the following mounts – mount 6 and mount 7 until the current month (mount 8).

If we want to be more accurate, the command will define a time range, which begins on 06/01 and
end on 08/15.

How to define a Time slider -01

1. Using the ge (Greater than or equal to) operator + time range.

When we use the PowerShell ““ge” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an event, that happened in the following time range: 06/01 until 08/15.

The “time range points” defined in the following way:

The “starting point” of the Time range is calculated by taking the current date and subtract two months from the current date.
In our example, the starting point is the first day of the month “6.”

The “End” of the time range is the “current date.”
In our example, the current date is day 15 of the month “8.”

Note – the value of the “current date” is just an arbitrary value that we use for the demonstration.

How to define a Time slider - Using the GE PowerShell operator -02

2. Using the le (Less than or equal to) operator + time range.

When we use the PowerShell “le” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an “event,” that happened before the following time range: 06/01.

How to define a Time slider - Using the LE PowerShell operator -03

In the following example, we would like to get information about Exchange Online mailboxes, that were created in a specific time range.

  1. The PowerShell “object” is an “Exchange Online mailbox.”
    (Represented by the PowerShell cmdlets – Get-Mailbox).
  2. The specific user account property which we “query” is – “WhenCreated.”
  3. The “time unit” that we use is – “Months.”

To be able to get a list of Exchange Online mailboxes that answer our specific query, we use the PowerShell cmdlets (statement) named – “Where,” for defining the condition, and filter the required information.

Looking for information about ?Exchange Online mailbox that were created in a specific time range -01

Scenario 1 – Information about Exchange mailboxes, that were created in the last two months.

In this scenario, we ask to get information about Exchange Online mailboxes, that were created in the last two months.
To define the “time range” that started two months ago, and last until the current date, we use the PowerShell operator ge (Greater than or equal to).

Scenario 1 - Show me all the Exchange Online mailbox that was created in the last two months -02

Scenario 2 – Information about Exchange mailboxes that were created Before last two months.

In this scenario, we ask to get information about Exchange Online mailboxes, that were created before the last two months.
To define the “time range” that started two months ago, from the current date, and last “forever,” we use the PowerShell operator – le (Less than or equal to).

Scenario 2 - Show me all the Exchange Online mailbox that was created Before last two months -03

Additional reading

In case that you want to read more information about the subject of “date” and PowerShell, you can use the following articles:

1#2 – Get information about the “Date \ Time”, in which Exchange Online mailbox was created.

In the following section, I provide various examples, of PowerShell command syntax, that will help us to filter information about – Get information about the “Date \ Time”, in which Exchange Online mailbox was created in a specific time range.

  • In the first part, we will look for information about Office 365 user accounts, that were created from a given date in the past to the present date.
  • In the second part, we will look for information about Office 365 user accounts, that were created before a specific Date range.

Scenario 1#2 – Getting information about Exchange Online mailbox, that was created in the last X time range.

The PowerShell “condition” that we define, based on the PowerShell operator -ge (Greater than or equal to).

In our examples, we want to get information about Exchange mailboxes that was created from a specified “point in time,” and thereafter (Greater than or equal to).

Display Exchange Online mailboxes that were created after a specific date.

In the following example, we look for Exchange Online mailboxes, that were created after the following date – 11/10/2016

PowerShell command syntax

PowerShell console output example

Display Exchange Online mailboxes that were created during the last X minutes.

In the following example, we look for Exchange Online mailboxes that were created in the last 160 minutes.

PowerShell command syntax

Display Exchange Online mailboxes that were created during the last X hours.

In the following example, we look for Exchange Online mailboxes that were created in the last 40 hours.

PowerShell command syntax

Display Exchange Online mailboxes that were created during the last X Days

In the following example, we look for Exchange Online mailboxes that were created in the last 20 Days.

PowerShell command syntax

Display Exchange Online mailboxes that were created during the last X Months

In the following example, we look for Exchange Online mailboxes that were created in the last 2 mounts.

PowerShell command syntax

Display Exchange Online mailboxes that were created in a specific month.

In the following example, we look for Exchange Online mailboxes that were created in mount August (8).

PowerShell command syntax

Display Exchange Online mailboxes that were created during the last X years.

In the following example, we look for Exchange Online mailboxes that were created in the last 2 years.

PowerShell command syntax

Display Exchange Online mailboxes that were created in a specific year.

In the following example, we look for Exchange Online mailboxes that were created during the year 2016.

Scenario 2#2 – Getting information about Exchange Online mailbox, that was created before a specific time range.

In the current scenario, we need to get information about Exchange Online mailboxes, that were created Before a specific time range (versus the former scenario in which we look for Exchange Online mailboxes that were created over the specified time range).

The time ranges that we define is – two months from the current date.
The information that we want to get is – information about Exchange Online mailboxes, that were created before this time range.

For example, in case that the current date is 12/15/2016, the results will be – all Exchange Online mailboxes that were created before the date – 10/01/2016.

To be able to fulfill this requirement, we use the PowerShell operator – -le (Less than or equal to).

Display Exchange Online mailboxes, that were created before X Days ago.

In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “40 days” or more.

PowerShell command syntax

Display Exchange Online mailboxes, that were created before X Months ago.

In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “2 months” or more.

PowerShell command syntax

2#2 – Get information about Exchange Online mailbox – Last Logon Date

In the following section, we review how to create a PowerShell query, that will display a “filtered search result” about – the Last Logon Date, in which Exchange user access or didn’t access, his Exchange Online mailbox.

Scenario 1#2 – Display information about Exchange Online mailboxes that were “used” by the user at a specific time.

In this scenario, we want to find information, about Exchange Online mailboxes, that were “used” (accessed) by their “owners” in a specific time range.

To be able to fulfill this requirement, we use the PowerShell operator “-ge” (Greater than or equal to).

For example, instead of saying – “I want to find Exchange Online mailboxes that was accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Greater than or equal to (ge) to “1 week.”

Note – If you need more information about available PowerShell operators, read the first article in the current article series.

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X minutes.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 160 minutes.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Hours.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 hours.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Days.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 days.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Mounts.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 mounts.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific Month.

In the following example, we look for Exchange Online mailboxes that were accessed in mount August (8).
PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific year.

In the following example, we look for Exchange Online mailboxes that were accessed in the year 2016.

PowerShell command syntax

Scenario 2#2 – Display information about Exchange Online mailboxes that were “NOT used” by the user in a specific time range.

In this scenario, we want to find information, about Exchange Online mailboxes, that wasn’t “used” (accessed) by their “owners” in a specific time range.

To be able to fulfill this requirement, we use the PowerShell operator “-le” (Less than or equal to).

For example, instead of saying – “I want to find Exchange Online mailboxes that wasn’t accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Less than or equal to (le) to “1 week.”

Note – If you need more information about available PowerShell operators, read the first article in the current article series.

This type of information can be useful for, finding out if you’re paying for any licenses that aren’t being used!

Display Exchange Online mailboxes, which was NOT accessed (user did not log in to the mailbox) by the user in the last X Mounts.

In the following example, we look for Exchange Online mailboxes that were not accessed in the last 2 mounts.

PowerShell command syntax

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years.

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.

PowerShell command syntax

Using a PowerShell menu based script for exporting information about Exchange Online recipients and mailboxes.

For your convenience, I have “Wrapped” all the PowerShell commands that were reviewed in the article,
in a “Menu Based” PowerShell Script.

You are welcome to download the PowerShell script and use it.
Download -o365info PowerShell Script

Use PowerShell for view Exchange Online objects


The PowerShell menu based script will help you, the “perform” a filter search for specific types of Exchange Online recipients or to perform a filter search on Exchange Online mailboxes that have specific property or attribute

The menu options that include in the PowerShell script are as follows:

  • Export information about – All Exchange Online mailboxes.
  • Export information about – Exchange mailboxes by type.
  • Export information about – Exchange all the type of Exchange recipients (contact, recipient, MailContact, etc.)
  • Export information about – Exchange Online groups (Distribution, Security, etc.)
  • Export information about – Exchange Online Public Folders.
  • Export information about – Exchange Online mailboxes that their E-mail address includes specific Domain name.
  • Export information about – Exchange Online mailboxes that their E-mail address includes specific Alias.
  • Export information about – Exchange Online Soft Deleted mailboxes.
  • Export information about – Exchange Online Inactive mailboxes.
  • Export information about – Exchange Online mailboxes with a specific Time zone.
  • Export information about – Exchange Online mailboxes with a specific Language code.
  • Export information about – Exchange Online mailboxes with Litigation Hold.
  • Export information about – Exchange Online mailboxes with In-Place Hold.
  • Export information about – Exchange Online mailboxes with Audit enabled.
  • Export information about – Exchange Online mailboxes with Forward E-mail option.
  • Export information about – Exchange Online mailboxes that are Hidden from Address Lists.
  • Export information about – Exchange Online mailboxes with an Archive mailbox.

The former article in the current article series

Use PowerShell for view Exchange Online and Office 365 objects | Article series index

Now it’s Your Turn!
It is important for us to know your opinion on this article

Print Friendly, PDF & Email

Related Post

Please rate this

Eyal Doron on EmailEyal Doron on FacebookEyal Doron on GoogleEyal Doron on LinkedinEyal Doron on PinterestEyal Doron on RssEyal Doron on TwitterEyal Doron on WordpressEyal Doron on Youtube
Eyal Doron
Share your knowledge.
It’s a way to achieve immortality.
Dalai Lama

Leave a Reply

Your email address will not be published. Required fields are marked *