This chapter covers Microsoft 365 Usage Analytics and Reports, a critical topic for the MS-102 exam under Tenant Management (Objective 1.2). You will learn how to access, interpret, and configure usage reports across Exchange, SharePoint, Teams, OneDrive, and Yammer. Understanding these reports is essential for monitoring adoption, troubleshooting underutilization, and justifying licensing costs. Approximately 5-8% of exam questions touch on usage analytics, often testing your ability to find specific metrics and understand report data retention.
Jump to a section
Think of Microsoft 365 Usage Analytics as a comprehensive security camera and badge-swipe system for an office building. The building has thousands of employees who enter and leave various rooms, use different amenities (like printers, conference rooms, and the cafeteria), and access different floors. The security system records every badge swipe: who entered, which door, what time, and how long they stayed. It also logs which printers are used most, which conference rooms are always booked, and which floors have the most foot traffic. The building manager can view dashboards showing peak usage times, popular areas, and underutilized spaces. Similarly, Microsoft 365 Usage Analytics collects telemetry from all workloads—Exchange Online, SharePoint, Teams, OneDrive, and Yammer—aggregating data on active users, file activity, meeting attendance, and storage consumption. The system processes this raw telemetry through a series of data pipelines, normalizing timestamps, deduplicating events, and aggregating counts. The resulting datasets are stored in a dedicated dataset within the Microsoft 365 admin center, accessible via pre-built reports and the Microsoft Graph API. Just as the building manager can drill down from a building-wide heatmap to a specific floor or room, an administrator can start with an organization-wide usage summary and filter by workload, location, or department. The system also supports retention policies: raw telemetry is retained for 7 days, aggregated daily snapshots for 30 days, and monthly rollups for up to 180 days. This allows trend analysis over time, spotting seasonal patterns or the impact of a new policy. If a security camera fails or a badge reader malfunctions, the data for that area becomes incomplete; similarly, if a workload's telemetry endpoint is misconfigured or blocked, usage reports will show gaps. The analogy underscores that the value lies not just in collecting data, but in the structured, queryable, and visualized output that informs decisions about licensing, training, and resource allocation.
What is Microsoft 365 Usage Analytics?
Microsoft 365 Usage Analytics is a built-in reporting feature within the Microsoft 365 admin center that provides administrators with pre-built dashboards and detailed reports on how users interact with Microsoft 365 services. It aggregates telemetry from Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, and Yammer. The primary purpose is to help organizations understand adoption patterns, identify underutilized services, and make data-driven decisions about training, licensing, and policy changes.
How It Works Internally
The reporting system relies on telemetry data collected from each workload. For example, Exchange Online logs every email sent, received, and read; SharePoint records file views, edits, and shares; Teams tracks meetings, calls, and messages; OneDrive logs file activity; and Yammer tracks posts and reactions. This raw telemetry is sent to a central data processing pipeline in Microsoft 365, where it undergoes:
Normalization: Timestamps are converted to UTC; user IDs are mapped to directory objects; activity types are categorized (e.g., 'FileModified', 'MeetingJoined').
Deduplication: Duplicate events caused by retries or multiple endpoints are removed.
Aggregation: Raw events are rolled up into counts per user per day per activity type. For example, instead of storing every individual file edit, the system stores a single count of 'FileModified' for user A on date X.
Aggregated data is stored in a dedicated dataset that powers the reports. The dataset is refreshed every 24-48 hours, meaning reports may show data up to 2 days old. The retention period for aggregated data is 30 days for daily snapshots, with monthly rollups retained for up to 180 days. Raw telemetry is retained for only 7 days to comply with privacy and storage policies.
Key Components and Defaults
- Usage Reports Dashboard: Located in the Microsoft 365 admin center under Reports > Usage. It shows an overview of active users, storage, and activity across workloads.
- Workload-Specific Reports: Each workload has its own detailed report. For example:
- Email activity: Shows email send, receive, read counts per user.
- SharePoint site usage: Shows file views, edits, shares, and storage per site.
- Teams usage: Shows active users, channel messages, meetings, and calls.
- OneDrive usage: Shows file activity, storage, and sharing per user.
- Yammer usage: Shows active users, posts, and reactions.
- Report Filters: You can filter by date range (7, 30, 90, or 180 days), by workload, by user, or by site. Filters are applied client-side after data is loaded.
- Export to CSV: Reports can be exported as CSV files for offline analysis. The CSV includes raw aggregated data for the selected period.
- Microsoft Graph API: All report data is accessible via the Graph API under the /reports endpoint. This allows custom dashboards and automation. The API returns JSON or CSV and supports filtering by period and activity type.
- Roles Required: To view usage reports, you need at least one of the following admin roles: Global admin, Reports reader, Exchange admin, SharePoint admin, or Teams admin. The Reports reader role is designed specifically for viewing reports without granting broader admin privileges.
Configuration and Verification Commands
While most reports are pre-built and require no configuration, you can verify access and data availability using PowerShell or Graph API.
PowerShell Example (Exchange Online):
Connect-ExchangeOnline
Get-MailboxActivityReport -ReportScope Organization -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)This returns email activity for the last 7 days.
Graph API Example:
GET https://graph.microsoft.com/v1.0/reports/getEmailActivityUserDetail(period='D7')The period parameter can be 'D7', 'D30', 'D90', or 'D180'. The response is a CSV or JSON depending on the Accept header.
To verify that reporting is enabled globally, check the organization's reporting settings:
Get-OrganizationConfig | Select-Object -Property IsReportExecutionEnabledIf False, reports will not generate data. This setting can be toggled with:
Set-OrganizationConfig -IsReportExecutionEnabled $trueInteraction with Related Technologies
Microsoft 365 admin center: The primary UI for reports. It integrates with the Microsoft 365 Defender portal for security reports and the Microsoft 365 compliance center for audit logs.
Microsoft Graph API: Enables developers to embed report data into custom applications or Power BI dashboards.
Power BI: Usage Analytics template apps are available for deeper analysis, connecting to the same underlying dataset.
Azure AD: User identity information (department, location, job title) from Azure AD enriches reports, allowing filtering by user attributes.
Microsoft 365 Groups: Group membership data is used to aggregate usage by team or department.
Data Refresh and Latency
Daily refresh: The dataset refreshes once every 24-48 hours. Data for the current day may be incomplete until the next refresh.
Latency: There is a built-in latency of up to 48 hours for some reports due to processing time. For example, Teams meeting attendance may appear after 24-48 hours.
Real-time data: Usage reports are not real-time. For near-real-time activity, use the Audit log (unified audit log) which has a latency of 30 minutes to 24 hours.
Privacy and Data Masking
By default, usage reports show user names, group names, and site names. To protect privacy, administrators can enable data masking in the admin center under Settings > Org Settings > Reports. When enabled, user names are replaced with pseudonyms (e.g., User1, User2). This setting applies to all reports and cannot be granularly configured per workload.
Data masking does not affect CSV exports; pseudonyms are still used.
The setting is off by default. Only Global admins can toggle it.
Common Use Cases Tested on MS-102
Identifying inactive users: Use the 'Inactive users' report under Users > Active users. It shows users who haven't logged in for 30, 60, or 90 days.
Comparing workload adoption: The Usage dashboard shows a side-by-side comparison of active users across workloads.
Storage consumption: SharePoint and OneDrive reports show storage used vs. allocated.
License utilization: While not directly a usage report, the 'Licenses' report under Billing > Licenses shows assigned vs. available licenses, which complements usage data.
Limitations
Reports are limited to the last 180 days of aggregated data. Older data is not available.
Data for guest users is included but may be incomplete if guest access is restricted.
Reports cannot be customized beyond built-in filters. For custom reports, use Graph API or Power BI.
Some workloads (e.g., Yammer) have separate admin centers with their own reporting capabilities that may not align perfectly with the unified reports.
Access the Usage Dashboard
Navigate to the Microsoft 365 admin center (https://admin.microsoft.com). In the left navigation, expand 'Reports' and select 'Usage'. The dashboard loads with a summary of active users across all workloads for the last 7 days by default. You can change the time period using the dropdown at the top right. The dashboard displays tiles for each workload (Email, SharePoint, Teams, OneDrive, Yammer) showing the number of active users. Clicking a tile opens the detailed report for that workload. The dashboard also shows a 'Top users' list and 'Storage' usage summary. This is the entry point for all usage analytics.
Filter by Date Range and Workload
On the Usage dashboard, use the date range filter to select 7, 30, 90, or 180 days. This filter applies to all tiles and subsequent drill-downs. To focus on a specific workload, click on its tile. For example, clicking 'Teams' opens the Teams Usage report. Here you can further filter by activity type (channel messages, meetings, calls) and by user or team. Filters are applied client-side, meaning the data for the selected period is already loaded from the server. Changing the date range triggers a new API call to fetch the appropriate dataset.
Interpret Report Metrics
Each workload report includes key metrics such as 'Active Users', 'Total Activity Count', and 'Storage Used'. For example, the Email activity report shows 'Send', 'Receive', and 'Read' counts per user. The Teams report shows 'Channel Messages', 'Meeting Attendance', and 'Call Duration'. Hovering over data points in charts reveals exact numbers. Below the charts, a table lists individual users or sites with their activity counts. You can sort columns by clicking the header. Understanding these metrics is critical for exam questions that ask you to identify adoption trends or compare usage between workloads.
Export Report Data to CSV
In any detailed report, click the 'Export' button at the top of the table. This generates a CSV file containing the underlying aggregated data for the selected period and filters. The CSV includes columns such as 'User Principal Name', 'Activity Type', 'Date', and 'Count'. Exported data respects the same date range and filters applied in the UI. Note that data masking (if enabled) also applies to the CSV. The export is useful for offline analysis in Excel or for importing into Power BI. The CSV is generated on-demand and downloaded immediately.
Use Graph API for Custom Reports
For automated or custom reporting, use the Microsoft Graph API. First, register an application in Azure AD with the 'Reports.Read.All' permission. Then, make a GET request to an endpoint like `https://graph.microsoft.com/v1.0/reports/getEmailActivityUserDetail(period='D30')`. The response is a CSV string by default, but you can request JSON by setting the `Accept` header to `application/json`. The API supports periods D7, D30, D90, D180. You can also use date-specific endpoints like `getEmailActivityUserDetail(date=2023-10-01)`. This method provides the same data as the admin center but allows integration into custom dashboards or scripts. Be aware of throttling limits: 10,000 requests per hour per app.
Scenario 1: Adoption Tracking for a Large Enterprise
A multinational corporation with 50,000 employees rolls out Microsoft Teams as its primary collaboration tool. The IT team needs to track adoption over time to justify the licensing cost and identify departments that need training. They use the Teams Usage report in the admin center, filtering by date range (90 days) and by department (using Azure AD attribute). They notice that the Sales department has only 30% active users compared to Engineering's 80%. They export the CSV and use Power BI to create a dashboard showing adoption trends per department. They also set up a weekly Graph API call to automatically fetch the latest data and update a SharePoint page with the metrics. The challenge is that the report has a 48-hour latency, so they cannot track immediate impact of a training session. They supplement with the Audit log for near-real-time activity. Misconfiguration: If the 'IsReportExecutionEnabled' setting is accidentally set to False, all reports show zero data. The admin must check this setting first when troubleshooting empty reports.
Scenario 2: Storage Optimization for a Mid-Sized Company
A company with 2,000 users is running out of SharePoint storage. The admin uses the SharePoint site usage report to identify sites with the highest storage consumption. They sort by 'Storage Used' descending and find that a project site from three years ago consumes 500 GB. The admin archives the site (makes it read-only) and reduces storage costs. They also use the OneDrive usage report to find users with over 1 TB of personal storage, then notify them to clean up. The reports show storage trends over 180 days, helping forecast future needs. A common mistake: admins think the 'Storage' metric in the dashboard includes all workloads, but it only shows SharePoint and OneDrive. Exchange and Teams storage are not included in the same view. They must use separate reports for each.
Scenario 3: License Optimization for a Non-Profit
A non-profit organization has 500 Microsoft 365 Business Basic licenses but only 300 users are active. The admin reviews the 'Active Users' report under Users > Active users to see who hasn't logged in for 90 days. They export the list of inactive users and decide to unassign licenses from 50 users who have been inactive for over 180 days. They also use the Email activity report to confirm that those users have zero email activity. However, they must be careful: a user might be inactive in email but active in Teams or SharePoint. The admin cross-references multiple workload reports before making license changes. This scenario is frequently tested on the exam: always check multiple workloads before decommissioning a license.
What MS-102 Tests on This Topic (Objective 1.2)
The exam expects you to:
Locate and interpret usage reports for each workload.
Understand data retention periods: raw telemetry 7 days, daily snapshots 30 days, monthly rollups 180 days.
Know the roles required to view reports: Global admin, Reports reader, Exchange admin, SharePoint admin, Teams admin.
Understand data masking: enabled via Settings > Org Settings > Reports; applies to all reports; off by default.
Know how to export reports and use Graph API.
Identify the correct report for a given scenario (e.g., which report shows inactive users? Answer: Users > Active users > Inactive users filter).
Common Wrong Answers and Why
'Usage reports are real-time.' Wrong because there is 24-48 hour latency. Candidates confuse audit log (near-real-time) with usage reports.
'Only Global admins can view usage reports.' Wrong because Reports reader role also has access. The exam tests least-privilege concepts.
'Data masking applies only to CSV exports.' Wrong because masking applies to both UI and exports. Candidates think CSV bypasses masking.
'The Usage dashboard shows storage for all workloads.' Wrong because it only shows SharePoint and OneDrive storage. Exchange and Teams storage are separate.
Specific Numbers and Terms
Retention: 7 days raw, 30 days daily, 180 days monthly.
Latency: 24-48 hours.
Roles: Reports reader is a specific role.
Data masking setting location: Settings > Org Settings > Reports.
Graph API period values: D7, D30, D90, D180.
PowerShell cmdlet: Get-OrganizationConfig | fl IsReportExecutionEnabled.
Edge Cases and Exceptions
If 'IsReportExecutionEnabled' is False, all reports show zero data. This is a common troubleshooting scenario.
Guest users: Their activity is included but may be incomplete if they don't have a full license.
Yammer reports: Only available if Yammer is enabled and configured. Some organizations use Yammer only for external networks, which may not appear in the unified reports.
Data masking does not hide site names or group names, only user names. This is a nuance the exam might test.
How to Eliminate Wrong Answers
If a question asks for real-time data, eliminate any answer that mentions usage reports; choose audit log instead.
If a question asks who can view reports without admin privileges, look for 'Reports reader' among the options.
For questions about data retention, remember the exact days: 7, 30, 180. The exam often mixes these up (e.g., 90 days is a distractor).
When asked about enabling/disabling reporting, remember the PowerShell cmdlet Set-OrganizationConfig.
Usage reports have a 24-48 hour latency; they are not real-time.
Data retention: raw telemetry 7 days, daily aggregates 30 days, monthly rollups 180 days.
Reports reader role can view all usage reports without being a Global admin.
Data masking is off by default and can be enabled under Settings > Org Settings > Reports.
Usage reports only show SharePoint and OneDrive storage; Exchange and Teams storage are separate.
To verify reporting is enabled, use PowerShell: Get-OrganizationConfig | fl IsReportExecutionEnabled.
Graph API endpoints for reports use periods D7, D30, D90, D180.
Inactive users report is under Users > Active users with a filter for inactivity duration.
These come up on the exam all the time. Here's how to tell them apart.
Usage Reports (Admin Center)
Pre-built dashboards and charts
24-48 hour latency
Aggregated data (counts per user per day)
Retained for 30-180 days
Requires Reports reader or higher role
Unified Audit Log
Raw event-level data
Near-real-time (30 min to 24 hours latency)
Individual actions (e.g., 'File Downloaded')
Retained for 90 days (default) or up to 1 year with add-on
Requires Audit Logs role or Global admin
Mistake
Usage reports show data in real-time.
Correct
There is a 24-48 hour latency. For near-real-time activity, use the unified audit log.
Mistake
Only Global admins can view usage reports.
Correct
Reports reader role also has full access to usage reports without other admin privileges.
Mistake
Data masking hides user names only in CSV exports.
Correct
Data masking applies to both the UI and CSV exports. When enabled, user names are pseudonymized everywhere.
Mistake
The Usage dashboard shows storage for all workloads.
Correct
It only shows SharePoint Online and OneDrive for Business storage. Exchange and Teams storage are not included in that view.
Mistake
Usage data is retained indefinitely.
Correct
Raw telemetry is kept for 7 days, daily aggregates for 30 days, and monthly rollups for 180 days. Older data is not available.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Usage data has a latency of 24 to 48 hours. For example, activity from Monday may not appear until Wednesday. This is because the system aggregates telemetry from multiple workloads and data centers. If you need near-real-time activity, use the unified audit log instead.
Yes, the Reports reader role provides read-only access to all usage reports. Other admin roles like Exchange admin, SharePoint admin, and Teams admin can view reports specific to their workload. You do not need Global admin privileges.
Go to Settings > Org Settings > Reports in the Microsoft 365 admin center. Toggle the setting to display anonymized user names. This applies to all reports and CSV exports. It is off by default. Only Global admins can change this setting.
Check the organization configuration using PowerShell: Get-OrganizationConfig | fl IsReportExecutionEnabled. If it is False, run Set-OrganizationConfig -IsReportExecutionEnabled $true. Also ensure you have the correct role and that the date range is appropriate. If the service has just been provisioned, it may take up to 48 hours for data to appear.
Yes, in any detailed report, click the 'Export' button at the top of the table. The CSV contains the same aggregated data shown in the UI, respecting any filters and date range. Data masking (if enabled) applies to the CSV as well.
Usage reports provide aggregated counts (e.g., number of emails sent per user per day) with a 24-48 hour latency and are retained for up to 180 days. Audit logs provide individual event-level details (e.g., each email send action) with near-real-time latency and are retained for 90 days by default (up to 1 year with add-on). Use audit logs for forensic investigation; use usage reports for adoption trends.
Make a GET request to https://graph.microsoft.com/v1.0/reports/getEmailActivityUserDetail(period='D30'). Replace the endpoint with the desired report and period (D7, D30, D90, D180). You need an app registration with Reports.Read.All permission. The response is a CSV by default; request JSON by setting Accept: application/json.
You've just covered Microsoft 365 Usage Analytics and Reports — now see how well it sticks with free MS-102 practice questions. Full explanations included, no account needed.
Done with this chapter?