Skip to content

Use PowerShell for view Exchange Online objects | Part 3#3

My primary goal in the current articles is to review the way that we use PowerShell as a tool for implementing “filtered search” in the Exchange Online based environment.

In some scenarios, we can use built PowerShell cmdlets, that enable us to query Exchange Online about a specific type of recipients.

The main option that we review in this article for implementing filtered search query is the PowerShell statement

Use PowerShell for view Office 365 and Exchange Online objects | Article series

The article series includes the following articles:

  1. Using the PowerShell “Where statement” for creating filtered search | Office 365 and Exchange Online objects
  2. Use PowerShell for view Office 365 objects
  3. Use PowerShell for view Exchange Online objects (this article)

The term “specific Exchange Online objects” can be translated to many types of scenarios.

For example

  • Example 1 – creating a PowerShell “Filtered search,” looking for a specific type of Online recipients such as – mail contacts, Exchange Groups, Public Folder, mailbox users and so on.
  • Example 2 – creating a PowerShell “Filtered search,” looking for Exchange Online mailboxes that their E-mail address includes the specific domain name or specific Alias.
  • Example 3 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox type such as – User mailbox, Shared mailbox, Room Mailbox and so on.
  • Example 4 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox such as – mailboxes with an archive, mailboxes with Litigation Hold, mailboxes with In-Place Hold, mailboxes with Audit enabled; Soft deleted Exchange Online mailbox, Inactive Exchange Online mailboxes and so on.
  • Example 5 – creating a PowerShell “Filtered search,” looking for a “property” of the Exchange Online mailbox user such as – user from a specific department, a user with a specific title, specific state or Province and so on.
  • Example 6 – creating a PowerShell “Filtered search,” looking for an Exchange mailboxes “Date information.” For example:
    • Exchange Online mailboxes that were created at a specific time (minutes, days, months, and years).
    • Exchange Online mailboxes that were accessed by a user (mailbox owner) on a specific time (minutes, days, months, and years).

Display information about Exchange mailboxes using the Get-Mailbox command

View all Exchange Online mailboxes vs. a default limited number

Exchange includes many types of mailboxes such as a user mailbox, shared mailbox, room mailbox and so on. By using the PowerShell command – Get-Mailbox, we ask to display all the types of Exchange mailboxes.

By default, the results from the PowerShell command Get-Mailbox display only the “first 1,000 Exchange mailboxes.”

Get-Mailbox

Display information about all the different type of Exchange Online mailboxes | No “limit” of the Exchange Online mailboxes number that will be displayed.

In case that we want to “extend” the default “1,000 result restriction” or to accurately indicate the Exchange Online mailboxes number that we want to display, we can use the parameter ResultSize.

The ResultSize parameter, specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter.

Get-Mailbox -ResultSize Unlimited

How to know which filter parameter I can use when I address Exchange Online mailbox object?

In the following article, we review different examples in which we create a Filtered search, looking for a specific property of Exchange Online mailbox.

In case that we want to get a list of all the available properties of a specific PowerShell object such as “Exchange Online mailbox,” we can use the PowerShell cmdlets – Get-Member

For example, to get a list of the properties (members) of the PowerShell command- Get-Mailbox that we can “query,” we can use the PowerShell command Get-Member.

An example of the PowerShell syntax that we use is:

Get information about PowerShell object properties

PowerShell command syntax:

Get-Mailbox * | Get-Member

PowerShell console output example:

PS C:\> Get-Mailbox * | Get-Member
TypeName: Deserialized.Microsoft.Exchange.Data.Directory.Management.Mailbox

Name                                   MemberType   Definition 
----                                   ----------   ---------- 
GetType                                Method       type GetType() 
ToString                               Method       string ToString(), string ToString(string format, System.IFormatProvider formatProvider), string IFormattable.ToString(string format, System.IFormatPr...
PSComputerName                         NoteProperty string PSComputerName=outlook.office365.com 
PSShowComputerName                     NoteProperty bool PSShowComputerName=False 
RunspaceId                             NoteProperty guid RunspaceId=35665d8e-40d6-4fb7-9f09-cc13bd844e99 
AcceptMessagesOnlyFrom                 Property     Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AcceptMessagesOnlyFromDLMembers        Property     Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AcceptMessagesOnlyFromSendersOrMembers Property     Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AccountDisabled                        Property     System.Boolean {get;set;} 
AddressBookPolicy                      Property     {get;set;}

Two useful PowerShell parameter that we can use | Count + Group-Object

In the following section, I would like to briefly review two useful PowerShell option that can be applied to the “results” that we get from the PowerShell command output.

Count the number of Exchange Online mailboxes

The PowerShell “count” option, enable us to “count” the results that are displayed by the PowerShell command.

In the following example, we use the PowerShell parameter “count” for counting the number of Exchange Online mailboxes that are “created” when we use the PowerShell command- Get-Mailbox.

Count the number of Exchange Online mailboxes

PowerShell command syntax:

Get-Mailbox -ResultSize Unlimited).Count

The PowerShell “Group-Object” option, enable us as the name suggests, the “Group” the results that are displayed by the PowerShell command.

In the following example, we ask to display information about all the existing type Public Folder Exchange Online mailbox, but in addition, we ask to – Group the result of the mailbox type.

Display information about all Exchange Online mailboxes | Group by the mailbox

PowerShell command syntax:

Get-Mailbox -ResultSize Unlimited | Group-Object -Property RecipientTypeDetails

PowerShell console output example:

PS C:\script> Get-Mailbox -ResultSize Unlimited | Group-Object -Property RecipientTypeDetails |ft

Count  Name               Group
-----  ----               -----
45     UserMailbox        {Adele, Alice Good, Alicia Keys...}
1      DiscoveryMailbox   {Discovery Search Mailbox}
9      SharedMailbox      {DMARC and Spoof E-mail, E-mail attachments Mailbox, Help desk support tickets, Shared-MB01...}
4      RoomMailbox        {Room03, room04, Room-MB01, Room-MB02}

Display information about a specific type of Exchange mailboxes

Exchange Online provides various types of “mailboxes” such as User mailbox, Room mailbox, Shared mailbox and much more.

In the following section, we can see examples of using a PowerShell command which will Filter the search results” by displaying only a specific type of Exchange Online mailboxes.

Filter the search result | Display information only about Exchange Online mailboxes considered as “User mailbox”

PowerShell command syntax:

Get-Mailbox | Where {$_.RecipientTypeDetails -eq “UserMailbox”} |FT Alias,RecipientTypeDetails

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.RecipientTypeDetails -eq “UserMailbox”} |FT DisplayName,RecipientTypeDetails

DisplayName        RecipientTypeDetails
-----------        --------------------
Adele              UserMailbox 
Alicia Keys        UserMailbox 
Angelina Jolie     UserMailbox 
Aretha Franklin    UserMailbox 
Beatles the        UserMailbox 
Beyonce            UserMailbox 
Billy              UserMailbox 
Bob marley         UserMailbox

Filter the search result | Display information only about Exchange Online mailboxes considered as “Room mailbox”

PowerShell command syntax:

Get-Mailbox | Where {$_.RecipientTypeDetails -eq “RoomMailbox”} | FT Alias,RecipientTypeDetails

Filter the search result | Display information only about Exchange Online mailboxes considered as “Shared mailbox”

PowerShell command syntax:

Get-Mailbox | Where {$_.RecipientTypeDetails -eq “SharedMailbox”} | FT Alias,RecipientTypeDetails

Filter the search result | Display information only about Exchange Online mailboxes considered as “Equipment mailbox”

PowerShell command syntax:

Get-Mailbox | Where {$_.RecipientTypeDetails -eq “EquipmentMailbox”} | FT Alias,RecipientTypeDetails

Note – If you want to view the “full list” of the various types of Exchange Online mailboxes, you can use the following article – RecipientTypeDetails enumeration.

Display information about a specific type of Exchange recipients

Exchange Online includes many types of “recipients.”

In the following section, we review the PowerShell commands, that will help us to “filter the search results” by looking for a specific Exchange Online recipient.

Display information about all Exchange Online recipients

PowerShell command syntax:

Get-Recipient | Sort RecipientType | Select DisplayName,RecipientType

PowerShell console output example:

PS C:\> Get-Recipient | Sort RecipientType | Select DisplayName,RecipientType 

DisplayName                  RecipientType 
-----------                  ------------- 
test-01                      DynamicDistributionGroup 
test-02                      DynamicDistributionGroup 
Test004                      MailUniversalDistributionGroup
Billy group                  MailUniversalDistributionGroup
Marketing                    MailUniversalDistributionGroup
ex2010                       MailUser 
test002                      PublicFolder 
test300                      PublicFolder 
Christina Aguilera           UserMailbox 
Chris Brown                  UserMailbox

Display information about all Exchange Online contacts

PowerShell command syntax:

Get-Contact | FT Name,RecipientType

Display information about all Exchange Online mail contacts

PowerShell command syntax:

Get-MailContact | FT Name,RecipientType

PowerShell console output example:

PS C:\> Get-MailContact | FT Name,RecipientType

Name                  RecipientType
----                  -------------
Allie Bellew          MailContact 
Chris Norred          MailContact 
Cindy White           MailContact

Display information about all Exchange Online mail users

In Exchange Hybrid environment, the On-Premise Active Directory user account that have Exchange on-Premises mailbox will be considered as Get-Mailuser.

Display information about all Exchange Online mail users

PowerShell command syntax:

Get-Mailuser | FT Name,RecipientType

PowerShell console output example:

PS C:\> Get-Mailuser | FT Name,RecipientType

Name            RecipientType
----            -------------
ed200           MailUser 
ex2007          MailUser 
ex2010          MailUser 
ex2013          MailUser

Display information about all Exchange Online users

PowerShell command syntax:

Get-User | Sort RecipientType | Select DisplayName,RecipientType

PowerShell console output example:

PS C:\> Get-User | Sort RecipientType | Select DisplayName,RecipientType 

DisplayName                RecipientType
-----------                -------------
ex2007                     MailUser 
ex2013                     MailUser 
Selena Gomez               User 
John Armstrong             User 
Nicki Minaj                UserMailbox 
Justin Bieber              UserMailbox

Display information about Exchange Online groups

In this section, we review the PowerShell commands that we can use for – displaying information about the Exchange Online Group and specific group type such as – Security Group, Distribution Group and so on.

Display information about all the available Exchange Online group types

PowerShell command syntax:

Get-Group | Sort GroupType |Select Name,DisplayName,GroupType

PowerShell console output example:

PS C:\> Get-Group | Sort GroupType |Select Name,DisplayName,GroupType

Name                               DisplayName              GroupType 
----                               -----------              --------- 
inbal01                            inbal01                  Universal 
SharedMailboxes-group              SharedMailboxes-group    Universal 
office365_3fdb9f3bff               office365                Universal 
Support                            Support                  Universal, SecurityEnabled
info                               info                     Universal, SecurityEnabled
ATP-users                          ATP-users                Universal, SecurityEnabled
test03                             test03                   Universal, SecurityEnabled
Mobile Users                       Mobile Users             Universal, SecurityEnabled

Display information about all Exchange Online groups that considered as – Distribution groups

PowerShell command syntax:

Get-DynamicDistributionGroup |FT Name,DisplayName,RecipientType

PowerShell console output example:

PS C:\> Get-DynamicDistributionGroup |FT Name,DisplayName,RecipientType

Name             DisplayName   RecipientType 
----             -----------   ------------- 
sm-dy            sm-dy         DynamicDistributionGroup
test-01          test-01       DynamicDistributionGroup
test-07          test-07       DynamicDistributionGroup

Display information about all Exchange Online groups that considered as – Unified groups

PowerShell command syntax:

Get-UnifiedGroup | FT Name,DisplayName,RecipientType,AccessType

PowerShell console output example:

PS C:\> Get-UnifiedGroup | FT Name,DisplayName,RecipientType,AccessType

Name                               DisplayName            RecipientType                   AccessType
----                               -----------            -------------                   ----------
BOB-OFFICE365_5d7917ddd4           BOB-OFFICE365          MailUniversalDistributionGroup  Public 
Eyal-001-uni_7eca52b0ac            Eyal-001-uni           MailUniversalDistributionGroup  Private 
Eyal-002-uni-PUBLIC_3bf86941dd     Eyal-002-uni-PUBLIC    MailUniversalDistributionGroup  Public 
office365_3fdb9f3bff               office365              MailUniversalDistributionGroup  Public

Display information about all Exchange Online groups that considered as a “Security group”

PowerShell command syntax:

Get-Group | Where {$_.GroupType -like "*security*"} | FT Name,DisplayName,GroupType

PowerShell console output example:

PS C:\> Get-Group | Where {$_.GroupType -like "*security*"} | FT Name,DisplayName, GroupType

Name                                   DisplayName GroupType 
----                                   ----------- --------- 
Organization Management                Universal, SecurityEnabled
Recipient Management                   Universal, SecurityEnabled
View-Only Organization Management      Universal, SecurityEnabled
UM Management                          Universal, SecurityEnabled

Display information about Exchange Online Public Folders

In this section, we review the PowerShell commands that we can use for – displaying information Exchange Online Public Folders.

Display information about all Exchange Online Public Folders

The PowerShell command – Get-MailPublicFolder, display information only about “top level” Public Folder hierarchy.

PowerShell command syntax

Get-MailPublicFolder |FT Alias,DisplayName,RecipientType,EmailAddresses

PowerShell console output example:

PS C:\> Get-MailPublicFolder |FT Alias,DisplayName,RecipientType

Alias       DisplayName      RecipientType
-----       -----------      -------------
root1       root             PublicFolder 
test002     test002          PublicFolder 
Jobs        Jobs             PublicFolder 
test300     test300          PublicFolder 
test400     test400          PublicFolder

Display information about Exchange Online Public Folders + “child Public Folders”

If you want to display the “full Public Folder hierarchy” that includes top level Public Folder + “child Public Folders,” you can use the following PowerShell command.

PowerShell command syntax:

Get-PublicFolder “\” -Recurse

PowerShell console output example:

PS C:\> Get-PublicFolder “\” -Recurse

Name                  Parent Path 
----                  ----------- 
IPM_SUBTREE 
Jobs                  \ 
Test200               \ 
test300               \ 
test400               \ 
layer-01-Test-400     \test400 
layer-02-test400      \test400\layer-01-Test-400
test500               \

Display Exchange Online mailboxes, that have E-mail address with a specific Domain name suffix or Alias

Find and display Exchange Online mailboxes with an E-mail address that include a specific domain name

Display all Exchange Online mailboxes which have an email with a specific domain name suffix

In the following example, we look for Exchange Online mailboxes, with E-mail address that includes the domain name – o365info.com

PowerShell command syntax:

Get-Mailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses

DisplayName    : Adele
EmailAddresses : {SPO:SPO_d5a46ab4-0922-4d9c-b2f3-3ddbff048a32@SPO_e95bcc9e-2927-483d-ad36-7311a7152bdd, smtp:Adele@o365info.com, SMTP:Adele@o365info2.onmicrosoft.com, SIP:Adele@o365info.com}

DisplayName    : Alicia Keys
EmailAddresses : {SIP:Alicia@o365info.com, smtp:Alicia@o365info2.onmicrosoft.com, SMTP:Alicia@o365info.com}

DisplayName    : Angelina Jolie
EmailAddresses : {SPO:SPO_5b27dc17-68b0-442e-804b-aee5b4df9847@SPO_e95bcc9e-2927-483d-ad36-7311a7152bdd, SIP:Angelina@o365info.com, SMTP:Angelina@o365info.com, smtp:Angelina@o365info2.onmicrosoft.com}

DisplayName    : Aretha Franklin
EmailAddresses : {SIP:Aretha@o365info.com, SMTP:Aretha@o365info.com, smtp:Aretha@o365info2.onmicrosoft.com}

Find and display Exchange Online mailboxes, with an E-mail address that includes a specific Alias

The exchange Online mailbox must have one E-mail address that defines as primary E-mail address buy can have an additional E-mail address which defines as – Proxy E-mail address.

When we look for a specific Alias (the “left part” of an E-mail address), we can define if we want to look for this alias only if the Alias appear on the primary E-mail address or look for an Alias that appear in all the Exchange Online Mailbox E-mail address.

Display all Exchange Online mailboxes which their primary E-mail address includes a specific alias

In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have a Primary E-mail address that includes the Alias name – Bob.

PowerShell command syntax:

Get-Mailbox | Where {$_.primarysmtpaddress -like "bob*"} | FL DisplayName,EmailAddresses

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.primarysmtpaddress -like "bob*"} | FL DisplayName,EmailAddresses

DisplayName    : Bob marley
EmailAddresses : {smtp:mrkt1@o365info.com, smtp:Albert@o365info.com, smtp:bobm@o365info.com, SIP:bob@o365info.com...}

Display all Exchange Online mailboxes, which their E-mail address includes a specific Alias

In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have E-mail address (any proxy E-mail address) that include the Alias name – Bob

PowerShell command syntax:

Get-Mailbox | Where {$_.EmailAddresses -like "*bob*"} | FL DisplayName, EmailAddresses

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.EmailAddresses -like "*bob*"} | FL DisplayName, EmailAddresses

DisplayName    : Bob marley
EmailAddresses : {smtp:mrkt1@o365info.com, smtp:Albert@o365info.com, smtp:bobm@o365info.com, SIP:bob@o365info.com...}

Display Exchange Online mailboxes – Soft Deleted mailboxes and Inactive mailboxes

In this section, we review how to use PowerShell commands that will restrict the search result only for Exchange Online mailboxes that considered as – Soft Deleted Exchange Online mailboxes or Inactive Exchange Online mailboxes.

Display information about all Exchange Online mailboxes that consider as – “Soft deleted mailboxes”

PowerShell command syntax:

Get-Mailbox -SoftDeletedMailbox | FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox

PowerShell console output example:

PS C:\> Get-Mailbox -SoftDeletedMailbox | FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox

Name                        Alias      IsSoftDeletedByRemove IsInactiveMailbox
----                        -----      --------------------- -----------------
room001                     room001                     True             False
Katy Perry                  Katy                        True             False
michael jackson             michael                     True             False
James Brown_eb17e65f06      James                       True             False
Test100                     Test100                     True              True
test501                     test501                     True             False
test500                     test500                     True             False

Display Exchange Online which their user account (owner) is disabled

PowerShell command syntax:

Get-mailbox | Where {$_.AccountDisabled -eq $True} | FT Alias, UserPrincipalName,AccountDisabled

PowerShell console output example:

PS C:\> Get-mailbox | Where {$_.AccountDisabled -eq $True} | FT Alias, UserPrincipalName,AccountDisabled 

Alias                                                           UserPrincipalName         AccountDisabled
-----                                                           -----------------         ---------------
Angelina                                                        Angelina@o365info.com     True
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}    DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@o365info.com True
DMARC-Spoof DMARC-Spoof@o365info.com                                                      True
hd                                                              hd@o365info.com True
Shared-MB01                                                     Shared-MB01@o365info.com  True
Shared-MB02                                                     Shared-MB02@o365info.com  True
Shared-MB03                                                     Shared-MB03@o365info.com  True

Display information about all Exchange Online mailboxes that consider as – “Inactive mailboxes “

PowerShell command syntax:

Get-Mailbox -InactiveMailboxOnly |FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox

PowerShell console output example:

PS C:\> Get-Mailbox -InactiveMailboxOnly |FT Name,Alias ,IsSoftDeletedByRemove,IsInactiveMailbox

Name         Alias     IsSoftDeletedByRemove IsInactiveMailbox
----         -----     --------------------- -----------------
Test100      Test100                    True              True

Display information about Exchange Online mailboxes that configured with a specific Time zone or specific language code”

Display information about Exchange Online mailboxes | Specific time zone

In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition.

Display Exchange mailboxes with a specific time zone

In the following example, we want to get information about Exchange Online mailboxes that their time zone is = “Pacific Standard Time.”

PowerShell command syntax:

Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.TimeZone -like "*Pacific Standard Time*"}

PowerShell console output example

PS C:\> Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.TimeZone -like "*Pacific Standard Time*"}

Identity       Language      DateFormat   TimeFormat     TimeZone 
--------       --------      ----------   ----------     -------- 
Demi           en-US         M/d/yyyy     h:mm tt        Pacific Standard Time 
Grace jones    en-US         M/d/yyyy     h:mm tt        Pacific Standard Time 
Rihanna        en-US         M/d/yyyy     h:mm tt        Pacific Standard Time

Note: when an OWA mail client selects this time zone, the time zone appears as – (GMT-08:00) Pacific Time (US and Canada).

Get a list of available Time Zones values

Tip – you can “fetch” information about values of Time Zones by using the following PowerShell command:

Get-ChildItem "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Time zones" | FL pschildname

PowerShell console output example:

PS C:\> Get-ChildItem "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Time zones" | FL pschildname

PSChildName : Afghanistan Standard Time

PSChildName : Alaskan Standard Time

PSChildName : Aleutian Standard Time

PSChildName : Altai Standard Time

PSChildName : Arab Standard Time

PSChildName : West Pacific Standard Time

PSChildName : Yakutsk Standard Time

You can read more information about the subject of – available values of “Time Zones,” in the following article: Microsoft Time Zone Index Values

Display information about Exchange Online mailboxes | Specific language

In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition.

Display information about Exchange Online mailboxes with a specific Language

In the following example, we want to display Exchange mailboxes, that their language settings = “en-GB”.

PowerShell command syntax:

Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.Language -like "*en-GB*"}

PowerShell console output example:

PS C:\> Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.Language -like "*en-GB*"}

Identity             Language       DateFormat TimeFormat TimeZone 
--------             --------       ---------- ---------- -------- 
Angelina             en-GB          dd/MM/yyyy HH:mm      Israel Standard Time 
Ayelet_9acbcfb3dc    en-GB          dd/MM/yyyy HH:mm      Israel Standard Time 
George Michael       en-GB          dd/MM/yyyy HH:mm      Israel Standard Time 
onprem120            en-GB          dd/MM/yyyy HH:mm      Samoa Standard Time

Display Exchange Online mailbox with Litigation hold or In-Place hold

In this section, we review the PowerShell commands that we can use for searching a specific Exchange Online mailbox, which configured as Exchange Online mailboxes with Litigation Hold or In-Place Hold.

Display information about Exchange Online mailboxes with Litigation Hold

PowerShell command syntax:

Get-Mailbox | Where {$_.LitigationHoldEnabled -match "True"} | FT Alias , lit*

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.LitigationHoldEnabled -match "True"} | FT Alias , lit*

Alias     LitigationHoldEnabled LitigationHoldDate       LitigationHoldOwner   LitigationHoldDuration
-----     --------------------- ------------------       -------------------   ----------------------
Adele     True                  11/23/2016 2:52:34 PM    George@o365info.com   6000.00:00:00 
bob       True                  12/11/2016 1:20:09 PM    George@o365info.com   6000.00:00:00 
Depeche   True                  2/3/2016 2:29:08 PM      Bradp@o365pilot.com   970.00:00:00

Display information about Exchange Online mailboxes with In-place Hold

PowerShell command syntax:

Get-Mailbox | Where {$_.InplaceHolds -ne $null} | FT Name,Alias,InPlaceHolds

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.InplaceHolds -ne $null} | FT Name,Alias,InPlaceHolds

Name         Alias     InPlaceHolds 
----         -----     ------------ 
Angelina     Angelina  {0e9a2a3160464d49a656127020a7c11a} 
Eyal200      Eyal200   {UniHd0bcaafd-c284-4bae-b46f-ef049559d45a}

Display Exchange Online mailboxes with Audit enabled

Display Exchange Online mailboxes with Audit enabled

PowerShell command syntax:

Get-Mailbox | Where {$_.AuditEnabled -eq “$True”} | FL Name,Alias,Audit*

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.AuditEnabled -eq “$True”} | Fl Name,Alias,Audit*

Name             : Adele
Alias            : Adele
AuditEnabled     : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin       : {Update, Copy, Move, MoveToDeletedItems...}
AuditDelegate    : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditOwner       : {Update, Move, MoveToDeletedItems, SoftDelete...}

Name             : bob
Alias            : bob
AuditEnabled     : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin       : {Update, Copy, Move, MoveToDeletedItems...}
AuditDelegate    : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditOwner       : {Update, Move, MoveToDeletedItems, SoftDelete...}

Display information about Exchange Online mailboxes, which was configured to automatically forward E-mail to another E-mail address

The “Forwarding option” can be configured to automatically forward each E-mail to another recipient in one of the following options:

Option 1 – Forwarding E-mail message to an internal recipient

A configuration in which the E-mail message, will automatically be forwarded to another “Office 365 recipients” (from the same Office 365 tenant).

This option defined by the PowerShell parameter – ForwardingAddress

Option 2 – Forwarding E-mail message to an external recipient

A configuration in which the E-mail message, will automatically be forwarded to another recipient who considered as “External recipient” meaning the recipient with the external email address.

This option defined by the PowerShell parameter – ForwardingSmtpAddress

Display Exchange Online mailboxes with E-mail forwarding enabled for an internal email address

PowerShell command syntax:

Get-Mailbox | Where {$_.ForwardingAddress -ne $null}| Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.ForwardingAddress -ne $null}| Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress

DisplayName              Alias         ForwardingAddress           ForwardingSmtpAddress 
-----------              -----         -----------------           --------------------- 
Angelina Jolie           Angelina      Eyal                        smtp:bradp@o365info.com
DMARC and Spoof E-mail   DMARC-Spoof   DMARC Report- dmarcian.com

Display Exchange Online mailboxes with E-mail forwarding enabled for an external email address

PowerShell command syntax:

Get-Mailbox | Where {$_.ForwardingSmtpAddress -ne $null} | Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.ForwardingSmtpAddress -ne $null} | Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress

DisplayName       Alias      ForwardingAddress ForwardingSmtpAddress 
-----------       -----      ----------------- --------------------- 
Angelina Jolie    Angelina   Eyal              smtp:bradp@o365info.com 
Bob marley        bob                          smtp:edron789@gmail.com

Display Exchange Online mailboxes, which doesn’t appear in the GAL

By default, each Exchange Online mailbox appears in the GAL (Global Address List).

In some case, specific Exchange Online mailboxes are configured to “not appear” (Mailboxes Hidden from Address Lists) in the GAL.

To be able to get a list of such Exchange Online mailboxes, we can use the following PowerShell command.

PowerShell command syntax:

Get-Mailbox | Where {$_.HiddenFromAddressListsEnabled -eq $True} | FT Name,Alias,HiddenFromAddressListsEnabled

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.HiddenFromAddressListsEnabled -eq $True} | FT Name,Alias,HiddenFromAddressListsEnabled

Name                                                         Alias                                                        HiddenFromAddressListsEnabled
----                                                         ----- -----------------------------
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} True
Elvis                                                        Elvis                                                        True

Display Exchange Online mailboxes with Archive mailbox

Display Exchange Online mailboxes that have an Archive

PowerShell command syntax:

Get-Mailbox | Where {$_.ArchiveStatus -eq 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.ArchiveStatus -eq 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus

Alias   RecipientTypeDetails ArchiveStatus
-----   -------------------- -------------
Alicia  UserMailbox          Active 
bradp   UserMailbox          Active 
mord    UserMailbox          Active

Display a list of Exchange Online mailboxes that doesn’t have an Archive

PowerShell command syntax:

Get-Mailbox | Where {$_.ArchiveStatus -ne 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus

OR

PowerShell command syntax:

Get-Mailbox | Where {$_.ArchiveStatus -eq 'none'} | FT Alias,RecipientTypeDetails,ArchiveStatus

PowerShell console output example:

PS C:\> Get-Mailbox | Where {$_.ArchiveStatus -ne 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus

Alias      RecipientTypeDetails ArchiveStatus
-----      -------------------- -------------
Adele      UserMailbox          None 
admin      UserMailbox          None 
Angelina   UserMailbox          None 
Aretha     UserMailbox          None 
Beatles    UserMailbox          None

Display Exchange Online mailboxes | Filter the results by specific property or a combination of properties of the user (mailbox owner)

In the following section, we review how to filter the search result by using a specific “user property” such as Department, Title, State or Province and so on.

The PowerShell “object” that we refer is – not the Exchange Online mailbox, but instead, an object which described as “Exchange user object” (Get-User)

When using the Exchange Online web management interface, the user properties displayed as part of the Exchange Online mailbox properties.

Although the user properties are displayed as “part of the Exchange Online mailbox,” to be able to filter the search result, we need to address the “Exchange Online mailbox owner” meaning -the user who considers as the Exchange Online mailbox’s owner, and not the Exchange Online mailbox herself.

Display “Exchange Online user’s mailboxes,” with a specific “Department” value

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department is – “Sales”

PowerShell command syntax:

Get-User | Where {$_.Department -eq “Sales”} |FT DisplayName,Department

PowerShell console output example:

PS C:\> Get-User | Where {$_.Department -eq “Sales”} |FT DisplayName,Department

DisplayName           Department
-----------           ----------
Brad Pitt             Sales 
Christina Aguilera    Sales

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department is – “Sales” or mailbox user department is – “Marketing”

PowerShell command syntax:

Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”)} | Select DisplayName,Department | Sort Department

PowerShell console output example:

PS C:\> Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”)} | Select DisplayName,Department | Sort Department

DisplayName           Department
-----------           ----------
Beatles the           Marketing 
Beyonce               Marketing 
Craig David           Marketing 
Brad Pitt             Sales 
Christina Aguilera    Sales

Display “Exchange Online user’s mailboxes,” with a specific “Department” value and specific “Title” value

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user title is – “Manager”
  • The user mailbox department is – “Sales”

PowerShell command syntax:

Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title

PowerShell console output example:

PS C:\> Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title

DisplayName    Department  Title 
-----------    ----------  ----- 
Brad Pitt      Sales       Manager

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y + specific Title value

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user title is – “Manager.”
  • The user mailbox department is – “Sales” or user mailbox department is – “Marketing.”

PowerShell command syntax:

Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title

PowerShell console output example:

PS C:\> Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title

DisplayName    Department  Title 
-----------    ----------  ----- 
Brad Pitt      Sales       Manager

Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department name start with a specific string

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The mailbox user department starts with the word – “Sales”

In this example, the company have couple of department that start with the word “sales” such as: Sales, Sales USA etc.

PowerShell command syntax:

Get-User | Where {$_.Department -like “Sales*”} | FT DisplayName,Department

PowerShell console output example:

PS C:\> Get-User | Where {$_.Department -like “Sales*”} | FT DisplayName,Department

DisplayName           Department
-----------           ----------
Aretha Franklin       Sales UK 
Brad Pitt             Sales 
Christina Aguilera    Sales 
Elvis Preslay         Sales USA

Display “Exchange Online user’s mailboxes,” that their Country or region is “not equal” to a specific Country or Region value

This requirement sound a little bit confusing.

An example for such a requirement could be – a company with many sites all over the world.
The company needs to get a list of Exchange Online users, that are locate in the company branches around the world, besides the company branch in USA (not in USA).

Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:

  • The user mailbox State Or Province is not USA

PowerShell command syntax:

Get-User | Where {$_.CountryOrRegion -ne “USA”} | FT DisplayName,CountryOrRegion

PowerShell console output example:

PS C:\> Get-User | Where {$_.CountryOrRegion -ne “USA”} | FT DisplayName,CountryOrRegion

DisplayName        CountryOrRegion
-----------        ---------------
Aretha Franklin    Israel 
Beatles the        United Kingdom 
Billy              United Kingdom 
Bob marley         Israel 
Brad Pitt          Australia

Display Exchange Online mailboxes | Filter the results by “Date information”

In the following section, we review how to create a PowerShell query, relate to the value of the “Date \ Time” of a specific object.

In our case, we are interested in getting information about Exchange Online mailboxes that have a specific property that has a specific value of “Date \ Time.”

I know that this definition seems a bit unclear, so we will provide more concrete examples in order as above.

Exchange Online mailbox object includes two “properties” that include a value of – “Date \ Time.”

  1. The first value is the “Date \ Time” in which the Exchange Online mailbox was created. This value defined as “WhenCreated.”
  2. The second value is – the “Date \ Time” in which the Exchange mailbox user (the mailbox owner) access (logged in) his Exchange Online mailbox. This value defined as “LastLogonTime.”

In the following section, I would like to start with an explanation of the way that we use PowerShell for implementing queries that relate to a “Date \ Time” value and then provide more specific examples of the PowerShell command syntax that we use for getting information about different “time frames” such as – Minutes, Hours, months, years and so on.

Before we start with the information about the specific PowerShell command syntax, let’s spend a few moments on the concept of – using PowerShell for a query “event” that occurs in a specific time range.

To create the PowerShell “time-based query,” we will need to define the following parameters:

  1. The object
    The specific object that we ask to obtain information about him. The object can be “User account,” “Exchange mailbox” and so on.
  2. The specific property of the object
    For example, in an Office 365 environment, we can ask to get information about a specific time, in which Exchange Online mailbox was created.
    In Office 365 the property that we “address” is – WhenCreated
  3. The Time unit
    PowerShell offers us a variety of “Time units” that we can use such as – Millisecond, Second, Minutes, Hour, Day, year and so on.
  4. PowerShell operator
    This is the specific PowerShell operator whom we use.

Using the PowerShell operator with “Time ranges”

In our example, I will demonstrate various scenarios, using the following two PowerShell operators:

  1. ge (Greater than or equal to).
    Using the “ge” operator will help us to get information about an “event” that “happened” from a specific point in time and onwards.
  2. le (Less than or equal to).
    Using the “le” operator will help us to get information about an “event” that happened before a specific point in time.

To be able to embody this concept, let’s use the following example:

The “starting point” is the PowerShell command – Get-Date, that “fetch” the current date (day, month, year and so on).

In our specific example, we want to define a “time range” of two months before the current date.

To define this time range, we use the following PowerShell command:

(Get-Date).AddMonths(-2)

We take the current date, and subtract from the current date “2 months.”

In our example, the “current time” is month 8 (August), and the day is “15.”

The result from the PowerShell command – (Get-Date).AddMonths(-2), will realize as a time range, which spans on the following months – month 6 and month 7 until the current month (month 8).

If we want to be more accurate, the command will define a time range, which begins on 06/01 and
end on 08/15.

  1. Using the ge (Greater than or equal to) operator + time range.

When we use the PowerShell ““ge” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an event, that happened in the following time range: 06/01 until 08/15.

The “time range points” defined in the following way:

The “starting point” of the Time range is calculated by taking the current date and subtract two months from the current date.
In our example, the starting point is the first day of the month “6.”

The “End” of the time range is the “current date.”
In our example, the current date is day 15 of the month “8.”

Note – the value of the “current date” is just an arbitrary value that we use for the demonstration.

  1. Using the le (Less than or equal to) operator + time range.

When we use the PowerShell “le” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an “event,” that happened before the following time range: 06/01.

In the following example, we would like to get information about Exchange Online mailboxes, that were created in a specific time range.

  1. The PowerShell “object” is an “Exchange Online mailbox.”
    (Represented by the PowerShell cmdlets – Get-Mailbox).
  2. The specific user account property which we “query” is – “WhenCreated.”
  3. The “time unit” that we use is – “Months.”

To be able to get a list of Exchange Online mailboxes that answer our specific query, we use the PowerShell cmdlets (statement) named – “Where,” for defining the condition, and filter the required information.

Scenario 1 – Information about Exchange mailboxes, that were created in the last two months.

In this scenario, we ask to get information about Exchange Online mailboxes, that were created in the last two months.

To define the “time range” that started two months ago, and last until the current date, we use the PowerShell operator ge (Greater than or equal to).

Scenario 2 – Information about Exchange mailboxes that were created Before last two months.

In this scenario, we ask to get information about Exchange Online mailboxes, that were created before the last two months.

To define the “time range” that started two months ago, from the current date, and last “forever,” we use the PowerShell operator – le (Less than or equal to).

1#2 – Get information about the “Date \ Time”, in which Exchange Online mailbox was created

In the following section, I provide various examples, of PowerShell command syntax, that will help us to filter information about – Get information about the “Date \ Time”, in which Exchange Online mailbox was created in a specific time range.

  • In the first part, we will look for information about Office 365 user accounts, that were created from a given date in the past to the present date.
  • In the second part, we will look for information about Office 365 user accounts, that were created before a specific Date range.

Scenario 1#2 – Getting information about Exchange Online mailbox, that was created in the last X time range.

The PowerShell “condition” that we define, based on the PowerShell operator -ge (Greater than or equal to)

In our examples, we want to get information about Exchange mailboxes that was created from a specified “point in time,” and thereafter (Greater than or equal to).

Display Exchange Online mailboxes that were created after a specific date

In the following example, we look for Exchange Online mailboxes, that were created after the following date – 11/10/2016

PowerShell command syntax:

Get-Mailbox | Where-Object {$_.WhenCreated –gt “11/10/2016”} | FT DisplayName,WhenCreated

PowerShell console output example:

PS C:\> Get-Mailbox | Where-Object {$_.WhenCreated –gt “11/10/2016”} | FT DisplayName,WhenCreated

DisplayName      WhenCreated 
-----------      ----------- 
Aretha Franklin  12/18/2016 9:01:58 AM 
Bob marley       11/17/2016 7:41:32 PM 
Demi Lovato      12/13/2016 1:23:08 PM 
Rihanna          12/13/2016 1:22:21 PM 
Shared-MB06      11/28/2016 3:31:46 PM 
Shared-MB07      11/28/2016 3:32:30 PM

Display Exchange Online mailboxes that were created during the last X minutes

In the following example, we look for Exchange Online mailboxes that were created in the last 160 minutes.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).Addminutes(-160))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created during the last X hours

In the following example, we look for Exchange Online mailboxes that were created in the last 40 hours.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddHours(-40))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created during the last X Days

In the following example, we look for Exchange Online mailboxes that were created in the last 20 Days.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).Adddays(-2))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created during the last X Months

In the following example, we look for Exchange Online mailboxes that were created in the last 2 months.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddMonths(-2))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created in a specific month.

In the following example, we look for Exchange Online mailboxes that were created in month August (8).

PowerShell command syntax:

Get-Mailbox | Where {($_.WhenCreated).Month –eq 8} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created during the last X years

In the following example, we look for Exchange Online mailboxes that were created in the last 2 years.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddYears(-2))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes that were created in a specific year

In the following example, we look for Exchange Online mailboxes that were created during the year 2016.

Scenario 2#2 – Getting information about Exchange Online mailbox, that was created before a specific time range.

In the current scenario, we need to get information about Exchange Online mailboxes, that were created Before a specific time range (vs. the previous scenario in which we look for Exchange Online mailboxes that were created over the specified time range).

The time ranges we define is – two months from the current date.
The information that we want to get is – information about Exchange Online mailboxes, that were created before this time range.

For example, in case the current date is 12/15/2016, the results will be – all Exchange Online mailboxes that were created before the date – 10/01/2016.

To fulfill this requirement, we use the PowerShell operator -le (Less than or equal to).

Display Exchange Online mailboxes, that were created before X Days ago

In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “40 days” or more.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).Adddays(-40))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes, that were created before X Days ago.

In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “40 days” or more.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).Adddays(-40))} | FT DisplayName,WhenCreated

Display Exchange Online mailboxes, that were created before X Months ago

In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “2 months” or more.

PowerShell command syntax:

Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).AddMonths(-2))} | FT DisplayName,WhenCreated

2#2 – Get information about Exchange Online mailbox – Last Logon Date

In the following section, we review how to create a PowerShell query, that will display a “filtered search result” about – the Last Logon Date, in which Exchange user access or didn’t access, his Exchange Online mailbox.

Scenario 1#2 – Display information about Exchange Online mailboxes that were “used” by the user at a specific time.

In this scenario, we want to find information, about Exchange Online mailboxes, that were “used” (accessed) by their “owners” in a specific time range.

To be able to fulfill this requirement, we use the PowerShell operator “-ge” (Greater than or equal to).

For example, instead of saying – “I want to find Exchange Online mailboxes that was accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Greater than or equal to (ge) to “1 week.”

Note – If you need more information about available PowerShell operators, read the first article in the current article series.

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X minutes

In the following example, we look for Exchange Online mailboxes that were accessed in the last 160 minutes.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).Addminutes(-160))} | FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Hours

In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 hours.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).AddHours(-40))}| FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Days

In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 days.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).Adddays(-30))}| FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Months

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 months.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).AddMonths(-2))}| FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific Month

In the following example, we look for Exchange Online mailboxes that were accessed in month August (8).

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {($_.LastLogonTime).Month –eq 8}| FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date). AddYears(-2))}| FT DisplayName,LastLogonTime

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific year

In the following example, we look for Exchange Online mailboxes that were accessed in the year 2016.

PowerShell command syntax

Get-Mailbox | Get-MailboxStatistics| Where-Object {($_.LastLogonTime).Year –eq 2016}| FT DisplayName,LastLogonTime -Autosize

Scenario 2#2 – Display information about Exchange Online mailboxes that were “NOT used” by the user in a specific time range.

In this scenario, we want to find information, about Exchange Online mailboxes, that wasn’t “used” (accessed) by their “owners” in a specific time range.

To be able to fulfill this requirement, we use the PowerShell operator “-le” (Less than or equal to).

For example, instead of saying – “I want to find Exchange Online mailboxes that wasn’t accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Less than or equal to (le) to “1 week.”

Note – If you need more information about available PowerShell operators, read the first article in the current article series.

This type of information can be useful for, finding out if you’re paying for any licenses that aren’t being used!

Display Exchange Online mailboxes, which was NOT accessed (user did not log in to the mailbox) by the user in the last X Months

In the following example, we look for Exchange Online mailboxes that were not accessed in the last 2 months.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –le ((Get-Date).AddMonths(-2))}| FT DisplayName,LastLogonTime -Autosize

Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years

In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.

PowerShell command syntax:

Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date). AddYears(-2))}| FT DisplayName,LastLogonTime -Autosize
o365info Team

o365info Team

This article was written by our team of experienced IT architects, consultants, and engineers.