Mailbox reports

    Overview

    The Mailbox Reports module in the product provides admins with pre-built reports on Exchange Online mailbox state, configuration, and permissions across the Microsoft 365 tenant. The reports cover mailbox lifecycle (created, deleted, disabled, soft-deleted), delegation and permission state (Send As, Send on Behalf, delegates), mail flow configuration (Inbox Rules, Transport Rules, forwarding), compliance state (Litigation Hold, ActiveSync), and mailbox feature configuration. These reports are useful for mailbox inventory audits, permission and delegation reviews, forwarding governance (particularly for external forwarding), and compliance evidence collection.

    The module covers 23 reports across five functional areas:

    Account status and lifecycle

    Permissions and delegation

    Mail flow rules

    Forwarding configuration

    Compliance and features

    How it works

    Every mailbox report follows the same generation pattern: select the Microsoft 365 tenant, optionally scope the report by domain (or by domains and groups for some reports), and click Generate Now. The generated report is rendered as a sortable, filterable table with standard report controls (Export As, Schedule Reports, search, filter, pagination) available above and within the table.

    Many mailbox reports support post-report management actions: select mailboxes from the report and click the Manage button above the table to apply actions such as Reset Password, Modify Licenses, Turn On Litigation Hold, Set Mailbox Storage Limits, Trust/Block Senders and Recipients, or Convert Mailbox without leaving the report.

    Prerequisites

    • A Microsoft 365 tenant must be configured in the product.
    • The configured service account must have read access to the tenant's Exchange Online configuration.

    Common steps to generate a mailbox report

    1. Click the Microsoft 365 tab.
    2. In the left pane, click Reports.
    3. Under Exchange Online, click Mailbox Reports.
    4. Click the required mailbox report from the landing page.
    5. Select the Microsoft 365 Tenant and any report-specific parameters listed in the report's section.
    6. Click Generate Now.

    Mailbox Users

    Lists every mailbox in the tenant, both user and shared, along with each mailbox's identity and directory attributes. Useful as the tenant-wide mailbox inventory and the baseline starting point before drilling into permission, forwarding, or feature-specific reports.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as turning on litigation hold, trusting or blocking senders and recipients, or setting mailbox storage limits.

    Recently Created Mailboxes

    Lists mailboxes created during the selected period, with each mailbox's creation timestamp, age in days, and recipient type (user, room, shared, and so on). Useful for validating that recent onboarding provisioned mailboxes of the expected type and on schedule, and for surfacing unexpected mailbox creation during a security review.

    Parameters: Microsoft 365 Tenant, Domains, Period (date-time range picker).

    Post-report actions: Select mailboxes and click Manage to apply actions such as turning on litigation hold, trusting or blocking senders and recipients, or setting mailbox storage limits.

    Soft Deleted Mailboxes

    Shows mailboxes that have been soft-deleted (deleted but still recoverable within the retention window) along with their soft-deletion time and litigation hold status. Useful for identifying mailboxes that need to be restored before the retention window expires, or for confirming that intentionally deleted mailboxes are queued for permanent removal.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Enabled Exchange Users

    Shows all Exchange Online users with an active mailbox. Useful as a baseline for understanding the active mailbox population in the organization and as the inverse of Disabled Exchange Users for completeness checks.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select users and click Manage to apply actions such as resetting passwords, modifying licenses, or deleting users.

    Disabled Exchange Users

    Shows all Exchange Online users whose mailboxes are disabled. Useful for identifying accounts that should be either re-enabled (if blocking was unintended) or fully decommissioned (if the user has left the organization).

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select users and click Manage to apply actions such as resetting passwords, modifying licenses, or deleting users.

    Shared Mailbox

    Opens as Shared Mailbox Permissions and shows the Full Access, Send As, and Send on Behalf permissions held on shared mailboxes. Shared mailboxes carry no dedicated license and are accessed by multiple users for team addresses (such as support@ or sales@). Useful for delegation reviews on team mailboxes and for confirming that access to shared addresses stays limited to the right owners.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Mailbox Folder Permissions

    Shows folder-level permissions configured on Exchange Online mailboxes (such as Calendar, Inbox, or Sent Items folder permissions granted to other users). Useful for auditing folder-level access on sensitive mailboxes (executive calendars, HR mailbox folders) where folder-level delegation is more common than full mailbox delegation.

    Parameters: Microsoft 365 Tenant.

    Mailbox Permissions

    Shows the Full Access, Send As, and Send on Behalf permissions held on Exchange Online mailboxes, covering both user and shared mailboxes. The whole-mailbox counterpart to Mailbox Folder Permissions: where that report covers individual folders, this one surfaces who can open an entire mailbox or send from it. Useful during access reviews of sensitive mailboxes, since full-mailbox and send permissions are higher-privilege grants than folder-level access and a common business email compromise vector.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select users and click Manage to apply actions such as resetting passwords, modifying licenses, or deleting users.

    Mailboxes with Delegates

    Shows mailboxes that have been delegated to other users along with delegate identities, Send On Behalf permission state, and license details. Useful for delegation audits and for identifying executive or shared mailboxes whose delegation surface needs periodic review.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Mailboxes without Delegates

    Shows mailboxes that have no delegates configured along with license information and last directory sync time. Useful for identifying mailboxes that should have delegation (such as executive mailboxes that may have lost their assistant delegate during an offboarding without proper handover) and for confirming the inverse of Mailboxes with Delegates for completeness.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as setting litigation hold, changing mailbox permissions, or performing mailbox conversion.

    Send As Permission

    Shows all accounts and objects (users, contacts, groups) in the tenant that have Send As permission on some mailbox. Useful for security audits of impersonation surface, since Send As lets the grantee send mail that appears to originate from the mailbox owner.

    Parameters: Microsoft 365 Tenant

    Send on Behalf Permission

    Shows all accounts and objects (users, contacts, groups) in the tenant that have Send on Behalf of permission on some mailbox. Unlike Send As Permission, Send on Behalf preserves the sender's identity in the message header (Sender on behalf of Mailbox Owner).

    Parameters: Microsoft 365 Tenant

    Users with Send As Permission

    Shows only the user accounts in the tenant that have Send As permission, scoping the broader Send As Permission report to user objects specifically. Useful when the audit needs to focus on individual user accountability rather than the full permission surface across all object types.

    Parameters: Microsoft 365 Tenant

    Users with Send On Behalf Permission

    Shows only the user accounts in the tenant that have Send On Behalf permission, scoping the broader Send on Behalf Permission report to user objects specifically.

    Parameters: Microsoft 365 Tenant

    Inbox Rules

    Shows the Inbox Rules configured on Exchange Online mailboxes (such as auto-forward, auto-reply, server-side move to folder). Useful for detecting suspicious Inbox Rules that may indicate compromised accounts: attackers frequently configure auto-forward rules to exfiltrate mail or auto-delete rules to hide their activity from the legitimate mailbox owner.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Transport Rule List

    Shows the Exchange Online transport (mail flow) rules configured at the tenant level along with the mail that matches them. Useful for auditing tenant-wide mail flow policies (such as DLP rules, external sender warnings, encryption triggers) and for confirming that mail is being routed and labeled according to organizational policy.

    Parameters: Microsoft 365 Tenant

    Mailbox with Forward To

    Shows mailboxes that have the Forward To option configured to redirect mail to another recipient. Useful as a starting point for forwarding audits, with follow-up reports drilling into internal versus external destinations.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as setting litigation hold, changing mailbox permissions, or performing mailbox conversion.

    Mailbox without Forward To

    Shows mailboxes that do not have the Forward To option configured. Useful as the inverse of Mailbox with Forward To for completeness checks.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as setting litigation hold, changing mailbox permissions, or performing mailbox conversion.

    Mailbox with External mail Forwarding

    Shows mailboxes that forward mail to external (non-tenant) domains. Useful for detecting data-exfiltration risk: external forwarding is one of the most common patterns in compromised-account incidents, and is often disabled by tenant-wide policy. Mailboxes flagged here warrant investigation.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Mailbox with Internal mail Forwarding

    Shows mailboxes that forward mail to internal (tenant) domains. Useful for tracking legitimate internal forwarding patterns (such as forwarding to a shared mailbox for team handover during leave) separately from the higher-risk external forwarding surface.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as setting litigation hold, changing mailbox permissions, or performing mailbox conversion.

    Litigation Hold Enabled Mailboxes

    Shows all mailboxes with Litigation Hold enabled. Useful for confirming that mailboxes subject to legal hold are correctly retained and as compliance evidence during ongoing litigation matters.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Post-report actions: Select mailboxes and click Manage to apply actions such as setting litigation hold, changing mailbox permissions, or performing mailbox conversion.

    ActiveSync Enabled Users

    Shows all Exchange Online users with ActiveSync (mobile device synchronization) enabled. Useful for mobile-access governance: in organizations that restrict mobile mail access to managed devices, this report identifies users whose ActiveSync may need to be re-evaluated against the current MDM policy.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Mailbox Features

    Shows a detailed view of mailbox features and protocols (OWA, MAPI, POP, IMAP, ActiveSync, EWS) configured per user mailbox. Useful for protocol-level governance: in security-sensitive environments, legacy protocols such as POP or IMAP are typically disabled at the tenant level, and this report identifies any user mailboxes still configured to use them.

    Parameters: Microsoft 365 Tenant, Domains/Groups (optional; scopes the report to specific domains or groups in the tenant).

    Tips

    • Mailbox with External Mail Forwarding surfaces a common data-exfiltration pattern: attackers configure external forwarding to ship copies of mail outside the tenant. When investigating a compromised account, this report should be one of the first checks.
    • Inbox Rules at the per-mailbox level catch attacker-configured rules (such as moving all replies to RSS Feeds to hide them from the owner) that wouldn't show up in tenant-wide reports. Schedule this report weekly with results delivered to the security team for executive, finance, and admin accounts.
    • Mailbox with Forward To and Mailbox without Forward To cover the full tenant mailbox population between them. Similarly for external vs internal forwarding. Running both halves confirms there are no gaps in the audit coverage.
    • Mailbox Features reveals which mailboxes still have POP, IMAP, or other legacy protocols enabled. Use the report to identify mailboxes that need protocol cleanup as part of security hardening (disabling unused or insecure protocols reduces the authentication attack surface).