The current article series, includes three articles that are dedicated to the subject of –…
Use PowerShell for view Exchange Online objects | Part 3#3
My primary goal in the current articles is to review the way that we use PowerShell as a tool for implementing “filtered search” in the Exchange Online based environment.
In some scenarios, we can use built PowerShell cmdlets, that enable us to query Exchange Online about a specific type of recipients.
The main option that we review in this article for implementing filtered search query is the PowerShell statement
Use PowerShell for view Office 365 and Exchange Online objects | Article series
The article series includes the following articles:
- Using the PowerShell “Where statement” for creating filtered search | Office 365 and Exchange Online objects
- Use PowerShell for view Office 365 objects
- Use PowerShell for view Exchange Online objects (this article)
The term “specific Exchange Online objects” can be translated to many types of scenarios.
For example
- Example 1 – creating a PowerShell “Filtered search,” looking for a specific type of Online recipients such as – mail contacts, Exchange Groups, Public Folder, mailbox users and so on.
- Example 2 – creating a PowerShell “Filtered search,” looking for Exchange Online mailboxes that their E-mail address includes the specific domain name or specific Alias.
- Example 3 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox type such as – User mailbox, Shared mailbox, Room Mailbox and so on.
- Example 4 – creating a PowerShell “Filtered search,” looking for a specific Exchange Online mailbox such as – mailboxes with an archive, mailboxes with Litigation Hold, mailboxes with In-Place Hold, mailboxes with Audit enabled; Soft deleted Exchange Online mailbox, Inactive Exchange Online mailboxes and so on.
- Example 5 – creating a PowerShell “Filtered search,” looking for a “property” of the Exchange Online mailbox user such as – user from a specific department, a user with a specific title, specific state or Province and so on.
- Example 6 – creating a PowerShell “Filtered search,” looking for an Exchange mailboxes “Date information.” For example:
- Exchange Online mailboxes that were created at a specific time (minutes, days, months, and years).
- Exchange Online mailboxes that were accessed by a user (mailbox owner) on a specific time (minutes, days, months, and years).
Display information about Exchange mailboxes using the Get-Mailbox command
View all Exchange Online mailboxes vs. a default limited number
Exchange includes many types of mailboxes such as a user mailbox, shared mailbox, room mailbox and so on. By using the PowerShell command – Get-Mailbox, we ask to display all the types of Exchange mailboxes.
By default, the results from the PowerShell command Get-Mailbox display only the “first 1,000 Exchange mailboxes.”
Get-Mailbox
Display information about all the different type of Exchange Online mailboxes | No “limit” of the Exchange Online mailboxes number that will be displayed.
In case that we want to “extend” the default “1,000 result restriction” or to accurately indicate the Exchange Online mailboxes number that we want to display, we can use the parameter ResultSize.
The ResultSize parameter, specifies the maximum number of results to return. If you want to return all requests that match the query, use unlimited for the value of this parameter.
Get-Mailbox -ResultSize Unlimited
How to know which filter parameter I can use when I address Exchange Online mailbox object?
In the following article, we review different examples in which we create a Filtered search, looking for a specific property of Exchange Online mailbox.
In case that we want to get a list of all the available properties of a specific PowerShell object such as “Exchange Online mailbox,” we can use the PowerShell cmdlets – Get-Member
For example, to get a list of the properties (members) of the PowerShell command- Get-Mailbox that we can “query,” we can use the PowerShell command Get-Member.
An example of the PowerShell syntax that we use is:
Get information about PowerShell object properties
PowerShell command syntax:
Get-Mailbox * | Get-Member
PowerShell console output example:
PS C:\> Get-Mailbox * | Get-Member
TypeName: Deserialized.Microsoft.Exchange.Data.Directory.Management.Mailbox
Name MemberType Definition
---- ---------- ----------
GetType Method type GetType()
ToString Method string ToString(), string ToString(string format, System.IFormatProvider formatProvider), string IFormattable.ToString(string format, System.IFormatPr...
PSComputerName NoteProperty string PSComputerName=outlook.office365.com
PSShowComputerName NoteProperty bool PSShowComputerName=False
RunspaceId NoteProperty guid RunspaceId=35665d8e-40d6-4fb7-9f09-cc13bd844e99
AcceptMessagesOnlyFrom Property Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AcceptMessagesOnlyFromDLMembers Property Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AcceptMessagesOnlyFromSendersOrMembers Property Deserialized.Microsoft.Exchange.Data.Directory.ADMultiValuedProperty`1[[Microsoft.Exchange.Data.Directory.ADObjectId, Microsoft.Exchange.Data.Director...
AccountDisabled Property System.Boolean {get;set;}
AddressBookPolicy Property {get;set;}
Two useful PowerShell parameter that we can use | Count + Group-Object
In the following section, I would like to briefly review two useful PowerShell option that can be applied to the “results” that we get from the PowerShell command output.
Count the number of Exchange Online mailboxes
The PowerShell “count” option, enable us to “count” the results that are displayed by the PowerShell command.
In the following example, we use the PowerShell parameter “count” for counting the number of Exchange Online mailboxes that are “created” when we use the PowerShell command- Get-Mailbox.
Count the number of Exchange Online mailboxes
PowerShell command syntax:
Get-Mailbox -ResultSize Unlimited).Count
The PowerShell “Group-Object” option, enable us as the name suggests, the “Group” the results that are displayed by the PowerShell command.
In the following example, we ask to display information about all the existing type Public Folder Exchange Online mailbox, but in addition, we ask to – Group the result of the mailbox type.
Display information about all Exchange Online mailboxes | Group by the mailbox
PowerShell command syntax:
Get-Mailbox -ResultSize Unlimited | Group-Object -Property RecipientTypeDetails
PowerShell console output example:
PS C:\script> Get-Mailbox -ResultSize Unlimited | Group-Object -Property RecipientTypeDetails |ft
Count Name Group
----- ---- -----
45 UserMailbox {Adele, Alice Good, Alicia Keys...}
1 DiscoveryMailbox {Discovery Search Mailbox}
9 SharedMailbox {DMARC and Spoof E-mail, E-mail attachments Mailbox, Help desk support tickets, Shared-MB01...}
4 RoomMailbox {Room03, room04, Room-MB01, Room-MB02}
Display information about a specific type of Exchange mailboxes
Exchange Online provides various types of “mailboxes” such as User mailbox, Room mailbox, Shared mailbox and much more.
In the following section, we can see examples of using a PowerShell command which will Filter the search results” by displaying only a specific type of Exchange Online mailboxes.
Filter the search result | Display information only about Exchange Online mailboxes considered as “User mailbox”
PowerShell command syntax:
Get-Mailbox | Where {$_.RecipientTypeDetails -eq “UserMailbox”} |FT Alias,RecipientTypeDetails
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.RecipientTypeDetails -eq “UserMailbox”} |FT DisplayName,RecipientTypeDetails
DisplayName RecipientTypeDetails
----------- --------------------
Adele UserMailbox
Alicia Keys UserMailbox
Angelina Jolie UserMailbox
Aretha Franklin UserMailbox
Beatles the UserMailbox
Beyonce UserMailbox
Billy UserMailbox
Bob marley UserMailbox
Filter the search result | Display information only about Exchange Online mailboxes considered as “Room mailbox”
PowerShell command syntax:
Get-Mailbox | Where {$_.RecipientTypeDetails -eq “RoomMailbox”} | FT Alias,RecipientTypeDetails
Filter the search result | Display information only about Exchange Online mailboxes considered as “Shared mailbox”
PowerShell command syntax:
Get-Mailbox | Where {$_.RecipientTypeDetails -eq “SharedMailbox”} | FT Alias,RecipientTypeDetails
Filter the search result | Display information only about Exchange Online mailboxes considered as “Equipment mailbox”
PowerShell command syntax:
Get-Mailbox | Where {$_.RecipientTypeDetails -eq “EquipmentMailbox”} | FT Alias,RecipientTypeDetails
Note – If you want to view the “full list” of the various types of Exchange Online mailboxes, you can use the following article – RecipientTypeDetails enumeration.
Display information about a specific type of Exchange recipients
Exchange Online includes many types of “recipients.”
In the following section, we review the PowerShell commands, that will help us to “filter the search results” by looking for a specific Exchange Online recipient.
Display information about all Exchange Online recipients
PowerShell command syntax:
Get-Recipient | Sort RecipientType | Select DisplayName,RecipientType
PowerShell console output example:
PS C:\> Get-Recipient | Sort RecipientType | Select DisplayName,RecipientType
DisplayName RecipientType
----------- -------------
test-01 DynamicDistributionGroup
test-02 DynamicDistributionGroup
Test004 MailUniversalDistributionGroup
Billy group MailUniversalDistributionGroup
Marketing MailUniversalDistributionGroup
ex2010 MailUser
test002 PublicFolder
test300 PublicFolder
Christina Aguilera UserMailbox
Chris Brown UserMailbox
Display information about all Exchange Online contacts
PowerShell command syntax:
Get-Contact | FT Name,RecipientType
Display information about all Exchange Online mail contacts
PowerShell command syntax:
Get-MailContact | FT Name,RecipientType
PowerShell console output example:
PS C:\> Get-MailContact | FT Name,RecipientType
Name RecipientType
---- -------------
Allie Bellew MailContact
Chris Norred MailContact
Cindy White MailContact
Display information about all Exchange Online mail users
In Exchange Hybrid environment, the On-Premise Active Directory user account that have Exchange on-Premises mailbox will be considered as Get-Mailuser.
Display information about all Exchange Online mail users
PowerShell command syntax:
Get-Mailuser | FT Name,RecipientType
PowerShell console output example:
PS C:\> Get-Mailuser | FT Name,RecipientType
Name RecipientType
---- -------------
ed200 MailUser
ex2007 MailUser
ex2010 MailUser
ex2013 MailUser
Display information about all Exchange Online users
PowerShell command syntax:
Get-User | Sort RecipientType | Select DisplayName,RecipientType
PowerShell console output example:
PS C:\> Get-User | Sort RecipientType | Select DisplayName,RecipientType
DisplayName RecipientType
----------- -------------
ex2007 MailUser
ex2013 MailUser
Selena Gomez User
John Armstrong User
Nicki Minaj UserMailbox
Justin Bieber UserMailbox
Display information about Exchange Online groups
In this section, we review the PowerShell commands that we can use for – displaying information about the Exchange Online Group and specific group type such as – Security Group, Distribution Group and so on.
Display information about all the available Exchange Online group types
PowerShell command syntax:
Get-Group | Sort GroupType |Select Name,DisplayName,GroupType
PowerShell console output example:
PS C:\> Get-Group | Sort GroupType |Select Name,DisplayName,GroupType
Name DisplayName GroupType
---- ----------- ---------
inbal01 inbal01 Universal
SharedMailboxes-group SharedMailboxes-group Universal
office365_3fdb9f3bff office365 Universal
Support Support Universal, SecurityEnabled
info info Universal, SecurityEnabled
ATP-users ATP-users Universal, SecurityEnabled
test03 test03 Universal, SecurityEnabled
Mobile Users Mobile Users Universal, SecurityEnabled
Display information about all Exchange Online groups that considered as – Distribution groups
PowerShell command syntax:
Get-DynamicDistributionGroup |FT Name,DisplayName,RecipientType
PowerShell console output example:
PS C:\> Get-DynamicDistributionGroup |FT Name,DisplayName,RecipientType
Name DisplayName RecipientType
---- ----------- -------------
sm-dy sm-dy DynamicDistributionGroup
test-01 test-01 DynamicDistributionGroup
test-07 test-07 DynamicDistributionGroup
Display information about all Exchange Online groups that considered as – Unified groups
PowerShell command syntax:
Get-UnifiedGroup | FT Name,DisplayName,RecipientType,AccessType
PowerShell console output example:
PS C:\> Get-UnifiedGroup | FT Name,DisplayName,RecipientType,AccessType
Name DisplayName RecipientType AccessType
---- ----------- ------------- ----------
BOB-OFFICE365_5d7917ddd4 BOB-OFFICE365 MailUniversalDistributionGroup Public
Eyal-001-uni_7eca52b0ac Eyal-001-uni MailUniversalDistributionGroup Private
Eyal-002-uni-PUBLIC_3bf86941dd Eyal-002-uni-PUBLIC MailUniversalDistributionGroup Public
office365_3fdb9f3bff office365 MailUniversalDistributionGroup Public
Display information about all Exchange Online groups that considered as a “Security group”
PowerShell command syntax:
Get-Group | Where {$_.GroupType -like "*security*"} | FT Name,DisplayName,GroupType
PowerShell console output example:
PS C:\> Get-Group | Where {$_.GroupType -like "*security*"} | FT Name,DisplayName, GroupType
Name DisplayName GroupType
---- ----------- ---------
Organization Management Universal, SecurityEnabled
Recipient Management Universal, SecurityEnabled
View-Only Organization Management Universal, SecurityEnabled
UM Management Universal, SecurityEnabled
Display information about Exchange Online Public Folders
In this section, we review the PowerShell commands that we can use for – displaying information Exchange Online Public Folders.
Display information about all Exchange Online Public Folders
The PowerShell command – Get-MailPublicFolder, display information only about “top level” Public Folder hierarchy.
PowerShell command syntax
Get-MailPublicFolder |FT Alias,DisplayName,RecipientType,EmailAddresses
PowerShell console output example:
PS C:\> Get-MailPublicFolder |FT Alias,DisplayName,RecipientType
Alias DisplayName RecipientType
----- ----------- -------------
root1 root PublicFolder
test002 test002 PublicFolder
Jobs Jobs PublicFolder
test300 test300 PublicFolder
test400 test400 PublicFolder
Display information about Exchange Online Public Folders + “child Public Folders”
If you want to display the “full Public Folder hierarchy” that includes top level Public Folder + “child Public Folders,” you can use the following PowerShell command.
PowerShell command syntax:
Get-PublicFolder “\” -Recurse
PowerShell console output example:
PS C:\> Get-PublicFolder “\” -Recurse
Name Parent Path
---- -----------
IPM_SUBTREE
Jobs \
Test200 \
test300 \
test400 \
layer-01-Test-400 \test400
layer-02-test400 \test400\layer-01-Test-400
test500 \
Display Exchange Online mailboxes, that have E-mail address with a specific Domain name suffix or Alias
Find and display Exchange Online mailboxes with an E-mail address that include a specific domain name
Display all Exchange Online mailboxes which have an email with a specific domain name suffix
In the following example, we look for Exchange Online mailboxes, with E-mail address that includes the domain name – o365info.com
PowerShell command syntax:
Get-Mailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.EmailAddresses -like "*@o365info.com"} | FL DisplayName,EmailAddresses
DisplayName : Adele
EmailAddresses : {SPO:SPO_d5a46ab4-0922-4d9c-b2f3-3ddbff048a32@SPO_e95bcc9e-2927-483d-ad36-7311a7152bdd, smtp:Adele@o365info.com, SMTP:Adele@o365info2.onmicrosoft.com, SIP:Adele@o365info.com}
DisplayName : Alicia Keys
EmailAddresses : {SIP:Alicia@o365info.com, smtp:Alicia@o365info2.onmicrosoft.com, SMTP:Alicia@o365info.com}
DisplayName : Angelina Jolie
EmailAddresses : {SPO:SPO_5b27dc17-68b0-442e-804b-aee5b4df9847@SPO_e95bcc9e-2927-483d-ad36-7311a7152bdd, SIP:Angelina@o365info.com, SMTP:Angelina@o365info.com, smtp:Angelina@o365info2.onmicrosoft.com}
DisplayName : Aretha Franklin
EmailAddresses : {SIP:Aretha@o365info.com, SMTP:Aretha@o365info.com, smtp:Aretha@o365info2.onmicrosoft.com}
Find and display Exchange Online mailboxes, with an E-mail address that includes a specific Alias
The exchange Online mailbox must have one E-mail address that defines as primary E-mail address buy can have an additional E-mail address which defines as – Proxy E-mail address.
When we look for a specific Alias (the “left part” of an E-mail address), we can define if we want to look for this alias only if the Alias appear on the primary E-mail address or look for an Alias that appear in all the Exchange Online Mailbox E-mail address.
Display all Exchange Online mailboxes which their primary E-mail address includes a specific alias
In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have a Primary E-mail address that includes the Alias name – Bob.
PowerShell command syntax:
Get-Mailbox | Where {$_.primarysmtpaddress -like "bob*"} | FL DisplayName,EmailAddresses
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.primarysmtpaddress -like "bob*"} | FL DisplayName,EmailAddresses
DisplayName : Bob marley
EmailAddresses : {smtp:mrkt1@o365info.com, smtp:Albert@o365info.com, smtp:bobm@o365info.com, SIP:bob@o365info.com...}
Display all Exchange Online mailboxes, which their E-mail address includes a specific Alias
In this case, we use the PowerShell parameter “Emailaddresses” looking for Exchange Online mailboxes, which have E-mail address (any proxy E-mail address) that include the Alias name – Bob
PowerShell command syntax:
Get-Mailbox | Where {$_.EmailAddresses -like "*bob*"} | FL DisplayName, EmailAddresses
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.EmailAddresses -like "*bob*"} | FL DisplayName, EmailAddresses
DisplayName : Bob marley
EmailAddresses : {smtp:mrkt1@o365info.com, smtp:Albert@o365info.com, smtp:bobm@o365info.com, SIP:bob@o365info.com...}
Display Exchange Online mailboxes – Soft Deleted mailboxes and Inactive mailboxes
In this section, we review how to use PowerShell commands that will restrict the search result only for Exchange Online mailboxes that considered as – Soft Deleted Exchange Online mailboxes or Inactive Exchange Online mailboxes.
Display information about all Exchange Online mailboxes that consider as – “Soft deleted mailboxes”
PowerShell command syntax:
Get-Mailbox -SoftDeletedMailbox | FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox
PowerShell console output example:
PS C:\> Get-Mailbox -SoftDeletedMailbox | FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox
Name Alias IsSoftDeletedByRemove IsInactiveMailbox
---- ----- --------------------- -----------------
room001 room001 True False
Katy Perry Katy True False
michael jackson michael True False
James Brown_eb17e65f06 James True False
Test100 Test100 True True
test501 test501 True False
test500 test500 True False
Display Exchange Online which their user account (owner) is disabled
PowerShell command syntax:
Get-mailbox | Where {$_.AccountDisabled -eq $True} | FT Alias, UserPrincipalName,AccountDisabled
PowerShell console output example:
PS C:\> Get-mailbox | Where {$_.AccountDisabled -eq $True} | FT Alias, UserPrincipalName,AccountDisabled
Alias UserPrincipalName AccountDisabled
----- ----------------- ---------------
Angelina Angelina@o365info.com True
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@o365info.com True
DMARC-Spoof DMARC-Spoof@o365info.com True
hd hd@o365info.com True
Shared-MB01 Shared-MB01@o365info.com True
Shared-MB02 Shared-MB02@o365info.com True
Shared-MB03 Shared-MB03@o365info.com True
Display information about all Exchange Online mailboxes that consider as – “Inactive mailboxes “
PowerShell command syntax:
Get-Mailbox -InactiveMailboxOnly |FT Name,Alias,IsSoftDeletedByRemove,IsInactiveMailbox
PowerShell console output example:
PS C:\> Get-Mailbox -InactiveMailboxOnly |FT Name,Alias ,IsSoftDeletedByRemove,IsInactiveMailbox
Name Alias IsSoftDeletedByRemove IsInactiveMailbox
---- ----- --------------------- -----------------
Test100 Test100 True True
Display information about Exchange Online mailboxes that configured with a specific Time zone or specific language code”
Display information about Exchange Online mailboxes | Specific time zone
In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition.
Display Exchange mailboxes with a specific time zone
In the following example, we want to get information about Exchange Online mailboxes that their time zone is = “Pacific Standard Time.”
PowerShell command syntax:
Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.TimeZone -like "*Pacific Standard Time*"}
PowerShell console output example
PS C:\> Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.TimeZone -like "*Pacific Standard Time*"}
Identity Language DateFormat TimeFormat TimeZone
-------- -------- ---------- ---------- --------
Demi en-US M/d/yyyy h:mm tt Pacific Standard Time
Grace jones en-US M/d/yyyy h:mm tt Pacific Standard Time
Rihanna en-US M/d/yyyy h:mm tt Pacific Standard Time
Note: when an OWA mail client selects this time zone, the time zone appears as – (GMT-08:00) Pacific Time (US and Canada).
Get a list of available Time Zones values
Tip – you can “fetch” information about values of Time Zones by using the following PowerShell command:
Get-ChildItem "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Time zones" | FL pschildname
PowerShell console output example:
PS C:\> Get-ChildItem "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Time zones" | FL pschildname
PSChildName : Afghanistan Standard Time
PSChildName : Alaskan Standard Time
PSChildName : Aleutian Standard Time
PSChildName : Altai Standard Time
PSChildName : Arab Standard Time
PSChildName : West Pacific Standard Time
PSChildName : Yakutsk Standard Time
You can read more information about the subject of – available values of “Time Zones,” in the following article: Microsoft Time Zone Index Values
Display information about Exchange Online mailboxes | Specific language
In the following example, we ask to filter the search result of Exchange Online mailboxes, that answer the following condition.
Display information about Exchange Online mailboxes with a specific Language
In the following example, we want to display Exchange mailboxes, that their language settings = “en-GB”.
PowerShell command syntax:
Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.Language -like "*en-GB*"}
PowerShell console output example:
PS C:\> Get-Mailbox | Get-MailboxRegionalConfiguration | Where {$_.Language -like "*en-GB*"}
Identity Language DateFormat TimeFormat TimeZone
-------- -------- ---------- ---------- --------
Angelina en-GB dd/MM/yyyy HH:mm Israel Standard Time
Ayelet_9acbcfb3dc en-GB dd/MM/yyyy HH:mm Israel Standard Time
George Michael en-GB dd/MM/yyyy HH:mm Israel Standard Time
onprem120 en-GB dd/MM/yyyy HH:mm Samoa Standard Time
Display Exchange Online mailbox with Litigation hold or In-Place hold
In this section, we review the PowerShell commands that we can use for searching a specific Exchange Online mailbox, which configured as Exchange Online mailboxes with Litigation Hold or In-Place Hold.
Display information about Exchange Online mailboxes with Litigation Hold
PowerShell command syntax:
Get-Mailbox | Where {$_.LitigationHoldEnabled -match "True"} | FT Alias , lit*
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.LitigationHoldEnabled -match "True"} | FT Alias , lit*
Alias LitigationHoldEnabled LitigationHoldDate LitigationHoldOwner LitigationHoldDuration
----- --------------------- ------------------ ------------------- ----------------------
Adele True 11/23/2016 2:52:34 PM George@o365info.com 6000.00:00:00
bob True 12/11/2016 1:20:09 PM George@o365info.com 6000.00:00:00
Depeche True 2/3/2016 2:29:08 PM Bradp@o365pilot.com 970.00:00:00
Display information about Exchange Online mailboxes with In-place Hold
PowerShell command syntax:
Get-Mailbox | Where {$_.InplaceHolds -ne $null} | FT Name,Alias,InPlaceHolds
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.InplaceHolds -ne $null} | FT Name,Alias,InPlaceHolds
Name Alias InPlaceHolds
---- ----- ------------
Angelina Angelina {0e9a2a3160464d49a656127020a7c11a}
Eyal200 Eyal200 {UniHd0bcaafd-c284-4bae-b46f-ef049559d45a}
Display Exchange Online mailboxes with Audit enabled
Display Exchange Online mailboxes with Audit enabled
Get-Mailbox | Where {$_.AuditEnabled -eq “$True”} | FL Name,Alias,Audit*
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.AuditEnabled -eq “$True”} | Fl Name,Alias,Audit*
Name : Adele
Alias : Adele
AuditEnabled : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin : {Update, Copy, Move, MoveToDeletedItems...}
AuditDelegate : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditOwner : {Update, Move, MoveToDeletedItems, SoftDelete...}
Name : bob
Alias : bob
AuditEnabled : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin : {Update, Copy, Move, MoveToDeletedItems...}
AuditDelegate : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditOwner : {Update, Move, MoveToDeletedItems, SoftDelete...}
Display information about Exchange Online mailboxes, which was configured to automatically forward E-mail to another E-mail address
The “Forwarding option” can be configured to automatically forward each E-mail to another recipient in one of the following options:
Option 1 – Forwarding E-mail message to an internal recipient
A configuration in which the E-mail message, will automatically be forwarded to another “Office 365 recipients” (from the same Office 365 tenant).
This option defined by the PowerShell parameter – ForwardingAddress
Option 2 – Forwarding E-mail message to an external recipient
A configuration in which the E-mail message, will automatically be forwarded to another recipient who considered as “External recipient” meaning the recipient with the external email address.
This option defined by the PowerShell parameter – ForwardingSmtpAddress
Display Exchange Online mailboxes with E-mail forwarding enabled for an internal email address
PowerShell command syntax:
Get-Mailbox | Where {$_.ForwardingAddress -ne $null}| Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.ForwardingAddress -ne $null}| Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress
DisplayName Alias ForwardingAddress ForwardingSmtpAddress
----------- ----- ----------------- ---------------------
Angelina Jolie Angelina Eyal smtp:bradp@o365info.com
DMARC and Spoof E-mail DMARC-Spoof DMARC Report- dmarcian.com
Display Exchange Online mailboxes with E-mail forwarding enabled for an external email address
PowerShell command syntax:
Get-Mailbox | Where {$_.ForwardingSmtpAddress -ne $null} | Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.ForwardingSmtpAddress -ne $null} | Select DisplayName,Alias,ForwardingAddress ,ForwardingSmtpAddress
DisplayName Alias ForwardingAddress ForwardingSmtpAddress
----------- ----- ----------------- ---------------------
Angelina Jolie Angelina Eyal smtp:bradp@o365info.com
Bob marley bob smtp:edron789@gmail.com
Display Exchange Online mailboxes, which doesn’t appear in the GAL
By default, each Exchange Online mailbox appears in the GAL (Global Address List).
In some case, specific Exchange Online mailboxes are configured to “not appear” (Mailboxes Hidden from Address Lists) in the GAL.
To be able to get a list of such Exchange Online mailboxes, we can use the following PowerShell command.
PowerShell command syntax:
Get-Mailbox | Where {$_.HiddenFromAddressListsEnabled -eq $True} | FT Name,Alias,HiddenFromAddressListsEnabled
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.HiddenFromAddressListsEnabled -eq $True} | FT Name,Alias,HiddenFromAddressListsEnabled
Name Alias HiddenFromAddressListsEnabled
---- ----- -----------------------------
DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} True
Elvis Elvis True
Display Exchange Online mailboxes with Archive mailbox
Display Exchange Online mailboxes that have an Archive
PowerShell command syntax:
Get-Mailbox | Where {$_.ArchiveStatus -eq 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.ArchiveStatus -eq 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus
Alias RecipientTypeDetails ArchiveStatus
----- -------------------- -------------
Alicia UserMailbox Active
bradp UserMailbox Active
mord UserMailbox Active
Display a list of Exchange Online mailboxes that doesn’t have an Archive
PowerShell command syntax:
Get-Mailbox | Where {$_.ArchiveStatus -ne 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus
OR
PowerShell command syntax:
Get-Mailbox | Where {$_.ArchiveStatus -eq 'none'} | FT Alias,RecipientTypeDetails,ArchiveStatus
PowerShell console output example:
PS C:\> Get-Mailbox | Where {$_.ArchiveStatus -ne 'Active'} | FT Alias,RecipientTypeDetails,ArchiveStatus
Alias RecipientTypeDetails ArchiveStatus
----- -------------------- -------------
Adele UserMailbox None
admin UserMailbox None
Angelina UserMailbox None
Aretha UserMailbox None
Beatles UserMailbox None
Display Exchange Online mailboxes | Filter the results by specific property or a combination of properties of the user (mailbox owner)
In the following section, we review how to filter the search result by using a specific “user property” such as Department, Title, State or Province and so on.
The PowerShell “object” that we refer is – not the Exchange Online mailbox, but instead, an object which described as “Exchange user object” (Get-User)
When using the Exchange Online web management interface, the user properties displayed as part of the Exchange Online mailbox properties.
Although the user properties are displayed as “part of the Exchange Online mailbox,” to be able to filter the search result, we need to address the “Exchange Online mailbox owner” meaning -the user who considers as the Exchange Online mailbox’s owner, and not the Exchange Online mailbox herself.
Display “Exchange Online user’s mailboxes,” with a specific “Department” value
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The mailbox user department is – “Sales”
PowerShell command syntax:
Get-User | Where {$_.Department -eq “Sales”} |FT DisplayName,Department
PowerShell console output example:
PS C:\> Get-User | Where {$_.Department -eq “Sales”} |FT DisplayName,Department
DisplayName Department
----------- ----------
Brad Pitt Sales
Christina Aguilera Sales
Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The mailbox user department is – “Sales” or mailbox user department is – “Marketing”
PowerShell command syntax:
Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”)} | Select DisplayName,Department | Sort Department
PowerShell console output example:
PS C:\> Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”)} | Select DisplayName,Department | Sort Department
DisplayName Department
----------- ----------
Beatles the Marketing
Beyonce Marketing
Craig David Marketing
Brad Pitt Sales
Christina Aguilera Sales
Display “Exchange Online user’s mailboxes,” with a specific “Department” value and specific “Title” value
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The mailbox user title is – “Manager”
- The user mailbox department is – “Sales”
PowerShell command syntax:
Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title
PowerShell console output example:
PS C:\> Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title
DisplayName Department Title
----------- ---------- -----
Brad Pitt Sales Manager
Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department X or Department Y + specific Title value
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The mailbox user title is – “Manager.”
- The user mailbox department is – “Sales” or user mailbox department is – “Marketing.”
PowerShell command syntax:
Get-User | Where {($_.Department -eq “Sales”) -or ($_.Department -eq “Marketing”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title
PowerShell console output example:
PS C:\> Get-User | Where {($_.Department -eq “Sales”) -and ($_.Title -eq “Manager”)} | FT DisplayName,Department,Title
DisplayName Department Title
----------- ---------- -----
Brad Pitt Sales Manager
Display “Exchange Online user’s mailboxes,” with a specific “Department” value | Department name start with a specific string
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The mailbox user department starts with the word – “Sales”
In this example, the company have couple of department that start with the word “sales” such as: Sales, Sales USA etc.
PowerShell command syntax:
Get-User | Where {$_.Department -like “Sales*”} | FT DisplayName,Department
PowerShell console output example:
PS C:\> Get-User | Where {$_.Department -like “Sales*”} | FT DisplayName,Department
DisplayName Department
----------- ----------
Aretha Franklin Sales UK
Brad Pitt Sales
Christina Aguilera Sales
Elvis Preslay Sales USA
Display “Exchange Online user’s mailboxes,” that their Country or region is “not equal” to a specific Country or Region value
This requirement sound a little bit confusing.
An example for such a requirement could be – a company with many sites all over the world.
The company needs to get a list of Exchange Online users, that are locate in the company branches around the world, besides the company branch in USA (not in USA).
Display a list of “Exchange Online user’s mailboxes,” which answer the following parameters:
- The user mailbox State Or Province is not USA
PowerShell command syntax:
Get-User | Where {$_.CountryOrRegion -ne “USA”} | FT DisplayName,CountryOrRegion
PowerShell console output example:
PS C:\> Get-User | Where {$_.CountryOrRegion -ne “USA”} | FT DisplayName,CountryOrRegion
DisplayName CountryOrRegion
----------- ---------------
Aretha Franklin Israel
Beatles the United Kingdom
Billy United Kingdom
Bob marley Israel
Brad Pitt Australia
Display Exchange Online mailboxes | Filter the results by “Date information”
In the following section, we review how to create a PowerShell query, relate to the value of the “Date \ Time” of a specific object.
In our case, we are interested in getting information about Exchange Online mailboxes that have a specific property that has a specific value of “Date \ Time.”
I know that this definition seems a bit unclear, so we will provide more concrete examples in order as above.
Exchange Online mailbox object includes two “properties” that include a value of – “Date \ Time.”
- The first value is the “Date \ Time” in which the Exchange Online mailbox was created. This value defined as “WhenCreated.”
- The second value is – the “Date \ Time” in which the Exchange mailbox user (the mailbox owner) access (logged in) his Exchange Online mailbox. This value defined as “LastLogonTime.”
In the following section, I would like to start with an explanation of the way that we use PowerShell for implementing queries that relate to a “Date \ Time” value and then provide more specific examples of the PowerShell command syntax that we use for getting information about different “time frames” such as – Minutes, Hours, months, years and so on.
Before we start with the information about the specific PowerShell command syntax, let’s spend a few moments on the concept of – using PowerShell for a query “event” that occurs in a specific time range.
To create the PowerShell “time-based query,” we will need to define the following parameters:
- The object
The specific object that we ask to obtain information about him. The object can be “User account,” “Exchange mailbox” and so on. - The specific property of the object
For example, in an Office 365 environment, we can ask to get information about a specific time, in which Exchange Online mailbox was created.
In Office 365 the property that we “address” is – WhenCreated - The Time unit
PowerShell offers us a variety of “Time units” that we can use such as – Millisecond, Second, Minutes, Hour, Day, year and so on. - PowerShell operator
This is the specific PowerShell operator whom we use.
Using the PowerShell operator with “Time ranges”
In our example, I will demonstrate various scenarios, using the following two PowerShell operators:
- ge (Greater than or equal to).
Using the “ge” operator will help us to get information about an “event” that “happened” from a specific point in time and onwards. - le (Less than or equal to).
Using the “le” operator will help us to get information about an “event” that happened before a specific point in time.
To be able to embody this concept, let’s use the following example:
The “starting point” is the PowerShell command – Get-Date, that “fetch” the current date (day, month, year and so on).
In our specific example, we want to define a “time range” of two months before the current date.
To define this time range, we use the following PowerShell command:
(Get-Date).AddMonths(-2)
We take the current date, and subtract from the current date “2 months.”
In our example, the “current time” is month 8 (August), and the day is “15.”
The result from the PowerShell command – (Get-Date).AddMonths(-2), will realize as a time range, which spans on the following months – month 6 and month 7 until the current month (month 8).
If we want to be more accurate, the command will define a time range, which begins on 06/01 and
end on 08/15.
- Using the ge (Greater than or equal to) operator + time range.
When we use the PowerShell ““ge” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an event, that happened in the following time range: 06/01 until 08/15.
The “time range points” defined in the following way:
The “starting point” of the Time range is calculated by taking the current date and subtract two months from the current date.
In our example, the starting point is the first day of the month “6.”
The “End” of the time range is the “current date.”
In our example, the current date is day 15 of the month “8.”
Note – the value of the “current date” is just an arbitrary value that we use for the demonstration.
- Using the le (Less than or equal to) operator + time range.
When we use the PowerShell “le” operator, with the combination of the command –
(Get-Date).AddMonths(-2), we ask from PowerShell, to show us information about an “event,” that happened before the following time range: 06/01.
In the following example, we would like to get information about Exchange Online mailboxes, that were created in a specific time range.
- The PowerShell “object” is an “Exchange Online mailbox.”
(Represented by the PowerShell cmdlets – Get-Mailbox). - The specific user account property which we “query” is – “WhenCreated.”
- The “time unit” that we use is – “Months.”
To be able to get a list of Exchange Online mailboxes that answer our specific query, we use the PowerShell cmdlets (statement) named – “Where,” for defining the condition, and filter the required information.
Scenario 1 – Information about Exchange mailboxes, that were created in the last two months.
In this scenario, we ask to get information about Exchange Online mailboxes, that were created in the last two months.
To define the “time range” that started two months ago, and last until the current date, we use the PowerShell operator ge (Greater than or equal to).
Scenario 2 – Information about Exchange mailboxes that were created Before last two months.
In this scenario, we ask to get information about Exchange Online mailboxes, that were created before the last two months.
To define the “time range” that started two months ago, from the current date, and last “forever,” we use the PowerShell operator – le (Less than or equal to).
1#2 – Get information about the “Date \ Time”, in which Exchange Online mailbox was created
In the following section, I provide various examples, of PowerShell command syntax, that will help us to filter information about – Get information about the “Date \ Time”, in which Exchange Online mailbox was created in a specific time range.
- In the first part, we will look for information about Office 365 user accounts, that were created from a given date in the past to the present date.
- In the second part, we will look for information about Office 365 user accounts, that were created before a specific Date range.
Scenario 1#2 – Getting information about Exchange Online mailbox, that was created in the last X time range.
The PowerShell “condition” that we define, based on the PowerShell operator -ge (Greater than or equal to)
In our examples, we want to get information about Exchange mailboxes that was created from a specified “point in time,” and thereafter (Greater than or equal to).
Display Exchange Online mailboxes that were created after a specific date
In the following example, we look for Exchange Online mailboxes, that were created after the following date – 11/10/2016
PowerShell command syntax:
Get-Mailbox | Where-Object {$_.WhenCreated –gt “11/10/2016”} | FT DisplayName,WhenCreated
PowerShell console output example:
PS C:\> Get-Mailbox | Where-Object {$_.WhenCreated –gt “11/10/2016”} | FT DisplayName,WhenCreated
DisplayName WhenCreated
----------- -----------
Aretha Franklin 12/18/2016 9:01:58 AM
Bob marley 11/17/2016 7:41:32 PM
Demi Lovato 12/13/2016 1:23:08 PM
Rihanna 12/13/2016 1:22:21 PM
Shared-MB06 11/28/2016 3:31:46 PM
Shared-MB07 11/28/2016 3:32:30 PM
Display Exchange Online mailboxes that were created during the last X minutes
In the following example, we look for Exchange Online mailboxes that were created in the last 160 minutes.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).Addminutes(-160))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created during the last X hours
In the following example, we look for Exchange Online mailboxes that were created in the last 40 hours.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddHours(-40))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created during the last X Days
In the following example, we look for Exchange Online mailboxes that were created in the last 20 Days.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).Adddays(-2))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created during the last X Months
In the following example, we look for Exchange Online mailboxes that were created in the last 2 months.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddMonths(-2))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created in a specific month.
In the following example, we look for Exchange Online mailboxes that were created in month August (8).
PowerShell command syntax:
Get-Mailbox | Where {($_.WhenCreated).Month –eq 8} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created during the last X years
In the following example, we look for Exchange Online mailboxes that were created in the last 2 years.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –ge ((Get-Date).AddYears(-2))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes that were created in a specific year
In the following example, we look for Exchange Online mailboxes that were created during the year 2016.
Scenario 2#2 – Getting information about Exchange Online mailbox, that was created before a specific time range.
In the current scenario, we need to get information about Exchange Online mailboxes, that were created Before a specific time range (vs. the previous scenario in which we look for Exchange Online mailboxes that were created over the specified time range).
The time ranges we define is – two months from the current date.
The information that we want to get is – information about Exchange Online mailboxes, that were created before this time range.
For example, in case the current date is 12/15/2016, the results will be – all Exchange Online mailboxes that were created before the date – 10/01/2016.
To fulfill this requirement, we use the PowerShell operator -le (Less than or equal to).
Display Exchange Online mailboxes, that were created before X Days ago
In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “40 days” or more.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).Adddays(-40))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes, that were created before X Days ago.
In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “40 days” or more.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).Adddays(-40))} | FT DisplayName,WhenCreated
Display Exchange Online mailboxes, that were created before X Months ago
In the following example, we want to get information about Exchange Online mailboxes, that were created prior to the time range of “2 months” or more.
PowerShell command syntax:
Get-Mailbox | Where {$_.WhenCreated –le ((Get-Date).AddMonths(-2))} | FT DisplayName,WhenCreated
2#2 – Get information about Exchange Online mailbox – Last Logon Date
In the following section, we review how to create a PowerShell query, that will display a “filtered search result” about – the Last Logon Date, in which Exchange user access or didn’t access, his Exchange Online mailbox.
Scenario 1#2 – Display information about Exchange Online mailboxes that were “used” by the user at a specific time.
In this scenario, we want to find information, about Exchange Online mailboxes, that were “used” (accessed) by their “owners” in a specific time range.
To be able to fulfill this requirement, we use the PowerShell operator “-ge” (Greater than or equal to).
For example, instead of saying – “I want to find Exchange Online mailboxes that was accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Greater than or equal to (ge) to “1 week.”
Note – If you need more information about available PowerShell operators, read the first article in the current article series.
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X minutes
In the following example, we look for Exchange Online mailboxes that were accessed in the last 160 minutes.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).Addminutes(-160))} | FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Hours
In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 hours.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).AddHours(-40))}| FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Days
In the following example, we look for Exchange Online mailboxes that were accessed in the last 40 days.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).Adddays(-30))}| FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Months
In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 months.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date).AddMonths(-2))}| FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific Month
In the following example, we look for Exchange Online mailboxes that were accessed in month August (8).
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {($_.LastLogonTime).Month –eq 8}| FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years
In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date). AddYears(-2))}| FT DisplayName,LastLogonTime
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in a specific year
In the following example, we look for Exchange Online mailboxes that were accessed in the year 2016.
PowerShell command syntax
Get-Mailbox | Get-MailboxStatistics| Where-Object {($_.LastLogonTime).Year –eq 2016}| FT DisplayName,LastLogonTime -Autosize
Scenario 2#2 – Display information about Exchange Online mailboxes that were “NOT used” by the user in a specific time range.
In this scenario, we want to find information, about Exchange Online mailboxes, that wasn’t “used” (accessed) by their “owners” in a specific time range.
To be able to fulfill this requirement, we use the PowerShell operator “-le” (Less than or equal to).
For example, instead of saying – “I want to find Exchange Online mailboxes that wasn’t accessed by their owner in the last week,” the PowerShell command will say – display Exchange Online mailboxes, that their “LastLogonTime” is Less than or equal to (le) to “1 week.”
Note – If you need more information about available PowerShell operators, read the first article in the current article series.
This type of information can be useful for, finding out if you’re paying for any licenses that aren’t being used!
Display Exchange Online mailboxes, which was NOT accessed (user did not log in to the mailbox) by the user in the last X Months
In the following example, we look for Exchange Online mailboxes that were not accessed in the last 2 months.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –le ((Get-Date).AddMonths(-2))}| FT DisplayName,LastLogonTime -Autosize
Display Exchange Online mailboxes, which was accessed (user login to the mailbox) by the user in the last X Years
In the following example, we look for Exchange Online mailboxes that were accessed in the last 2 years.
PowerShell command syntax:
Get-Mailbox | Get-MailboxStatistics| Where-Object {$_.LastLogonTime –ge ((Get-Date). AddYears(-2))}| FT DisplayName,LastLogonTime -Autosize