How can I effectively audit the usage of M365 groups and distribution lists?
Asked by
TechWhiz123
I'm managing a tenant with approximately 300 distribution lists (DLs) and mail-enabled M365 groups. I've managed to gather a report that shows the owner and member counts for each group, but now I'm looking to audit their actual usage. My goal is to find out if the DLs are actively utilized and to understand the primary purpose of these M365 groups—I'm guessing they're mainly for shared calendars and email communications. I'm hoping to avoid manually tracing messages for each group in the Exchange Admin Center, and I'm finding it challenging to figure out how to do this with PowerShell. If anyone has resources or alternative methods to assess their usage and purpose, I'd greatly appreciate it. Thanks!
Answers
One straightforward method could be to send a mass email to the distribution groups asking, "Is this still in use? If not, I'll be deleting it soon." You may dream about it, but it could bring some clarity! Also, if you haven’t already, you might think about restricting group creation to a select few people to manage this better in the future.
Reply to this answer
You can pull a usage report from the Exchange Admin Center, although you'll need to do some manual filtering. Just keep in mind that the reports typically only go back about three months.
Reply to this answer
You can definitely audit this using PowerShell! Start with the Get-MessageTraceV2 command. Just remember that you'll need to send requests in 10-day increments and then reassemble the data afterwards. If you're not super savvy with PowerShell, you can use AI tools like GitHub Copilot to help generate a working script. There's a helpful function I found on Pastebin that outputs the results to CSV, so you can adjust the columns to fit your needs.
Oh, and you could also try using Get-HistoricalSearch, but be aware that you'll have to wait for all searches to complete before downloading each CSV.
Reply to this answer
Another way you can do this is via PowerShell with Start-HistoricalSearch. This method also allows you to look back about 90 days. Definitely check Microsoft's documentation for more details!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions