The price of Office 365 and Microsoft 365 licenses increased on March 1, 2022, by an extra $3 or so per month may not seem like much, but avoiding license fees for unused mailboxes is always a good thing. Moreover, email activity is only one aspect of how people use Office 365, and most people don’t pay for Exchange Online separately because it is bundled in many SKUs. Many Office 365 users have lowered the amount of email they send and receive by shifting messaging to Teams in the latest years, which also suggests that collecting and analyzing activity data from several workloads is a better way to figure out to see if an account is active or not like activities on Teams.
Investigating Mailbox Information Sources
We will use info extracted from user mailboxes to evaluate whether or not mailboxes were in use. I will be concerned about user mailboxes because they require licenses. Shared mailboxes unless they are larger than 50 GB or have an archive are not required licenses. There is some different method to achieve the goal.
- Microsoft 365 Reports in the admin center – Mailbox usage:
The Mailbox usage report displays information about users who have a user mailbox as well as their level of activity based on email send, read, create an appointment, send meeting, accept meeting, decline meeting, and cancel meeting task. It also shows how much storage has been used by each user’s mailbox and how many of them are reaching storage quotas. The mailbox usage report also includes information on shared mailboxes, such as storage and quota information for shared mailboxes.
In the admin center, click on the Reports and then the Usage page.
From the Product reports select Exchange and then Mailbox usage.
We can get info about the organization’s mailbox usage by the Mailbox, Storage, and Quota charts.
Keep in mind that you have to unhide user-level information when you’re generating your reports It can be achieved in the Microsoft 365 admin center:
Settings, Org settings, Service Page
select reports and uncheck the statement Display concealed user, group, and site names in all reports, then save.
2. PowerShell We can use the Get-EXOMailboxStatistics:
We can use the Get-EXOMailboxStatistics – Identity upn@domain name cmdlet to get information about a mailbox, such as its size, number of messages, and the last time it was accessed. We can also obtain the move history or a move report for a completed move request.
Info about how to use the MgGraph ReportUnusedExoMailboxes script on my GitHub Repo
It is supposed that we have all info and we have to investigate what unused mail-enabled accounts. We or someone else from our company may contact the mailbox owner to get more info or investigate who is using them. We have some options to avoid license converting the mailbox to a shared mailbox. However, if the mailbox owner uses other workloads, they may need a license s that includes Exchange Online, so converting the mailbox to a shared mailbox have a minor impact and can be converted back to a regular mailbox without issues.
We may suspend their Microsoft 365 accounts. After the account is deleted, the employee’s mailbox data is kept for 30 days. We can still recover the mailbox data during this time by undeleting the account. The data is permanently deleted after 30 days. However, if a hold is placed on the mailbox before deleting the Microsoft 365 account, the mailbox will be converted to an inactive mailbox. The sections that follow provide information on holds that can be used with Microsoft 365 retention and eDiscovery holds.
So, we may put the mailbox on litigation hold. With this method, we may deactivate the mailbox and release any licenses associated with the account. Placing mailboxes on hold protects data by avoiding items in the Recoverable Items folder from being deleted until the hold duration specified for an item expires. Items will not be purged from a mailbox if a hold is configured to hold items indefinitely. When a mailbox is placed on hold, the original version of a message is saved before it is modified. To meet your organization’s email retention requirements, combine Litigation Hold with a Retention Policy that can automatically delete messages and move them into the Recoverable Items folder after a specified period.
If the account is active in other Microsoft 365 workloads, this is a bad approach to take, which is why the data analyzed includes the last sign-in date from Azure AD.
You may know better your environment and the effective policies that are in place in the organization.
The choice is yours
More Info:
Microsoft 365 admin center mailbox usage reports – Microsoft 365 admin | Microsoft Learn
Thanos is an IT Manager that led Intralot the cloud migration project to Microsoft Azure. The project was the largest migration in Central and Eastern Europe (CEE Region) to Microsoft Azure for the year 2021. Manage and lead large IT projects, including the design and deployment of existing – new IT systems and services. Responsible for leading, developing, and managing the staff that develops, supports and maintains technical solutions within the Group Enterprise IT consists of the Systems Engineer Team, Network Team, and End Users Support Teams. Also, I operate as a technical lead and subject matter expert in providing end-to-end engineering advice and support in respect of one or more areas of Complex Infrastructure systems services. Skilled in a variety of Suites, Computer Science, IAAS, and Strong information technology professional.
MSc in CyberSecurity at the University of West Attica, Bachelor focused in Computer Science at the Hellenic Open University. Certified by Microsoft, VMware, PeopleCert: ITIL, MCP, VCP, Azure Fundamentals, Azure Virtual Desktop Specialty, Azure Administrator Associate, Azure Security Engineer Associate, Microsoft Azure Solution Architect Expert.