Transcript Service Life Cycle Scenario EXO Buy  Provisioning LYO SPO Office365 (suite wide)  Licenses Storage Consume   Device – Software  Device – Connections  User - Email activity  User - Docs activity User - Meetings activity User - External Sharing   

Service Life Cycle Scenario
EXO
Buy

Provisioning
LYO
SPO
Office365
(suite
wide)

Licenses
Storage
Consume


Device – Software

Device – Connections

User - Email activity

User - Docs activity
User - Meetings activity
User - External Sharing



Portal Definition
Number of active and inactive
mailboxes over time. A mailbox is
considered inactive if a user has not
logged in for more than 30 days.
Number of inactive mailboxes are
grouped by the number of days the
user has not logged in
Technical Definition – Active
Mailbox
Mailbox is connected
Mailbox has been logged into in past 30
days (from store)
OR Mailbox has been created in past 30
days (from AD)
Technical Definition – InActive
Mailbox
Mailbox Level Details
Via Reporting Web Service and CMDLets
Web Service/ODATA API
StaleMailbox
StaleMailboxDetail
CMDLets
Get-StaleMailboxReport
Get-StaleMailboxDetailReport
Mailbox is connected
Mailbox has not been logged into in past 30
days (from store)
Mailbox was created more than 30 days ago
(from AD)
Note!
Inactive Mailbox here does not refer to
the “inactive” mailbox state as defined
by ligation hold. Yes, we know this is
very confusing.
Portal Definition
Shows the number of total number of
mailboxes, inactive mailboxes,
mailboxes exceeding their storage
quota, and mailboxes using less than
25% of their storage limit.
Technical Definition – Total Mailbox
Mailbox Level Details
Technical Definition – InActive Mailbox
Web Service/ODATA API
MailboxUsage
MailboxUsageDetail
Source (AD)
All connected Mailboxes
Mailbox is connected
Mailbox has not been logged into in past 30 days (from
store)
Mailbox was created more than 30 days ago (from AD)
Technical Definition – Exceeds Storage
Limit
Source AD (MBX limits)
Source Store (MBX size)
Over limit if MBX total item size is over
IssueWarningQuota
Technical Definition – < 25% storage
Source AD (MBX limits)
Source Store (MBX size)
< 25% of ProhibitSendReceiveQuota
Via Reporting Web Service and CMDLets
CMDLets
Get-MailboxUsageReport
Get-MailboxUsageDetailReport
Portal Definition
Shows the number of mailbox
connections made over time, grouped
by connection types.
Technical Definition – Protocols
Mailbox Level Details
Technical Definition – Protocol
Count
Web Service/ODATA API
ConnectionByClientType (daily, weekly,
monthly, yearly)
ConnectionbyClientTypeDetail
MAPI, OWA, EAS, EWS, IMAP, POP3
Café (CAS) logs for each protocol
Distinct MBX accessed per day
Aggregated daily
Via Reporting Web Service and CMDLets
CMDLets
Get-ConnectionByClientTypeReport
Get-ConnectionByClientTypeDetailReport
Portal Definition
Shows the number of active mailboxes,
and the number of mailboxes created
and deleted. A mailbox is considered
active if a user has accessed it at least
once in the last 30 days.
Technical Definition – Total
Active Mailbox
Mailbox is connected
Mailbox has been logged into in past 30 days
(from store)
OR Mailbox has been created in past 30 days
(from AD)
Technical Definition –Mailbox
Created
Source (AD)
Mailbox was created or reconnected in a day
Does not count inter-day softdeletes/restores
Aggregated daily
Technical Definition –Mailbox
Deleted
Source (AD)
Mailbox was soft deleted or removed in a day
Does not count inter-day softdeletes/restores
Aggregated daily
Mailbox Level Details – Not
Available
Summary Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailBoxActivity (daily, weekly, monthly,
yearly)
CMDLets
Get-MailboxActivityReport
Portal Definition
Shows the number of groups created
and deleted.
Technical Definition – Group
Created
Source (AD)
Groups created daily (WhenCreated==Today)
Does not currently include DDGs (planned)
Aggregated daily.
Technical Definition –Mailbox
Deleted
Source (AD)
Groups deleted daily (WhenDeleted==Today)
Does not currently include DDGs (planned)
Aggregated Daily.
Group Level Details – Not
Available
Summary Via Reporting Web Service and
CMDLets
Web Service/ODATA API
GroupActivity (daily, weekly, monthly,
yearly)
CMDLets
Get-GroupActivityReport
Portal Definition
Shows received mail based on
traffic type
Technical Definitions
Good Mail - messages
that were received and not
identified as spam or
malware
Spam - messages
identified as spam
Malware - messages that
contained malware
Transport rules messages that matched at
least one rule
DLP - messages that
matched at least one DLP
policy
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventTypes
GoodMail
Malware
TransportRuleHits
SpamEnvelopeBlock
SpamIPBlock
SpamContentFiltered
Portal Definition
Shows what spam was detected, grouped by
spam filtering type.
Technical Definitions
SMTP Blocked- Sender
and recipient filtering
IP Blocked -The
reputation of the
connecting IP address is
evaluated by means of lists
from partners and thirdparty providers
Content filtered - content
is checked for terminology
or properties common to
spam
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventTypes
SpamEnvelopeBlock
SpamIPBlock
SpamContentFiltered
Portal Definition
Shows the number of malware detections in received
mail, before the malware action was applied
Technical Definitions
Viruses infect other
programs and data, and
they spread throughout
your computer looking for
programs to infect.
Spyware refers to malware
that gathers your personal
information, such as signin information and
personal data, and sends it
back to its author.
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventType
Malware
Portal Definition
Shows the number of transport rule matches in
received mail, grouped by severity.
Technical Definitions
Severity is defined by the admin for
each transport rule created
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventType
TransportRuleHits
Portal Definition
Shows the number of transport rule matches in
received mail, grouped by severity.
Technical Definitions
Policy Matches: daily count of DLP policies
that were matched.
Overrides: daily count of the DLP Policies
that were overridden by the user.
False Positive: Daily count of DLP Policies
that were reported as False Positive
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventType
DLPPolicyHits
DLPPolicyOverride
DLPPolicyFalsePositive
Portal Definition
Shows the number of DLP rule matches in received
mail, grouped by severity.
Technical Definitions
Severity is defined by the admin for
each transport rule created
Mail Level Details
Via Reporting Web Service and
CMDLets
Web Service/ODATA API
MailTraffic
CMDLets
Get-MailTraffic
EventType
DLPPolicyRuleHits
Mail Traffic
Mail Traffic
Email
EOP
O365
Report Console
Report
Data
O365
Console
Report
Data
Exchange
Reporting
Datamarts
PowerShell
Reporting
WebService
(odata)
WSAPI
Report
Data
SPO
Report
Data
LYO
Remote
PowerShell
Mail Traffic
Mail Traffic
Email
EOP
O365
Report Console
Report
Data
O365
Console
Report
Data
Exchange
Reporting
Datamarts
PowerShell
Reporting
WebService
(odata)
WSAPI
Report
Data
SPO
Report
Data
LYO
Remote
PowerShell
Mail Traffic
Mail Traffic
Email
EOP
O365
Report Console
Report
Data
O365
Console
Report
Data
Exchange
Reporting
Datamarts
PowerShell
Reporting
WebService
(odata)
WSAPI
Report
Data
SPO
Report
Data
LYO
Remote
PowerShell
Mail Traffic
Mail Traffic
Email
EOP
O365
Report Console
Report
Data
O365
Console
Report
Data
Exchange
Reporting
Datamarts
PowerShell
Reporting
WebService
(odata)
WSAPI
Report
Data
SPO
Report
Data
LYO
Remote
PowerShell
Session
SPR.202
SPR.201
SPR.UN.305
SPR.UN.304
SPR.401
SPR.203
SPR.301
SPR.401
Title
Encryption in Exchange
Eliminate the Regulatory
Compliance Nightmare
Exchange Online
Protection: Notes from the
field
Experts Unplugged: EOP &
Encryption
Extending Data Loss
Prevention For Your
Business
Protect your Organization
with Exchange Online
Protection (EOP)
So how does Microsoft
handle my spam?
Using Connectors & Mail
Routing
Timing
Room
Tue 10:45 AM - 12:00 PM Ballroom E
Tue 9:00 AM-10:15 AM
MR 19ab
Wed 10:15 AM – 11:30
AM
Wed 8:30-9:45 AM
Wed 1:00-2:15 PM
Ballroom G
MR 18d
MR 17b
Wed 4:45 PM- 6:00 PM
MR 18bc
Mon 4:30 PM - 5:45 PM MR 18bc
Tue 4:45 PM – 6:00 PM
MR 19ab
Wed 2:45 PM - 4:00 PM MR 18bc
Session
SPR.202
ARC.304
EDC.302
EDC.UN.301
EDC.204
MNG.304
MNG.301
Title
Encryption in Exchange
Exchange Server 2013
Transport Architecture
Advanced Data Loss
Prevention in Exchange
Experts Unplugged: Data Loss
Prevention
Data Loss Prevention in
Exchange, Outlook, OWA
Reporting On O365 Mail flow
and Mailbox Data
Exchange Admin Center getting administration done
Timing
Room
Tue 10:45 AM - 12:00 PM
Ballroom E
Tues 9:00 AM - 10:15 AM
Ballroom F
Tues 1:30 PM-2:45 PM
Tue 3:00 PM-4:15 PM
Wed 10:15 AM-11:30 AM
Ballroom F
MR 18d
MR 13ab
Mon 2:45 Pm-4:00PM
MR 18bc
Wed 1:00 PM-2:15 PM
MR 17a
Wed 10:15 AM - 11:30 AM MR 18bc