Microsoft 365 Usage Reports and Analytics

Microsoft 365 usage reports are pre-built dashboards and detailed data sets within the Microsoft 365 admin center that show how users are engaging with various services (Exchange Online, SharePoint Online, Teams, OneDrive for Business, Yammer, etc.). They exist to answer critical business questions: Are employees using the tools we pay for? Which features are underutilized? Are there security or compliance risks from inactive accounts? Without these reports, administrators would have to manually query each service's audit logs or PowerShell cmdlets, which is time-consuming and inconsistent.

Microsoft 365 collects telemetry from each service at the user activity level. For example, when a user sends an email, Exchange Online logs the action with a timestamp, sender, recipient count, and subject (subject is anonymized in reports). These logs are aggregated into the Microsoft 365 reporting data store, which is separate from the audit log (Unified Audit Log). The aggregation process runs once every 24 to 48 hours. Therefore, reports are not real-time; they reflect data from the previous day or earlier.

Key internal components: - Activity types: Each service defines what constitutes an "active user." For Exchange, sending or reading an email counts. For Teams, any chat, call, or meeting participation counts. For SharePoint, viewing, editing, uploading, or downloading a file counts. - Data retention: Usage report data is retained for up to 28 days for most reports. Historical data beyond 28 days is not available in the admin center; you must use Microsoft Graph API or export reports to get longer retention. - Aggregation: Reports are aggregated at the tenant level and can be filtered by product (e.g., Teams user activity report) or by date range (7, 30, 90, or 180 days for some reports like adoption trends).

- Report categories: - Adoption reports: Show trends over time (e.g., how many active users per month for the last 6 months). - Activity reports: Show per-user activity for a specific product (e.g., number of emails sent, meetings organized). - License utilization reports: Show how many assigned licenses are actually being used. - Security and compliance reports: (Covered in other chapters) but include DLP policy matches, threat detections. - Data freshness: Reports are typically updated every 24–48 hours. The exact update time varies by service. The report header shows the last update timestamp. - Default retention: 28 days. To keep data longer, you must use the Microsoft Graph API to export and store reports. - Permissions: To view usage reports, a user must have one of the following roles: Global Administrator, Reports Reader, Security Administrator, Exchange Administrator, SharePoint Administrator, or Teams Administrator (depending on the report). The Reports Reader role is specifically designed for read-only access to usage reports without granting other admin privileges.

You can access reports via the Microsoft 365 admin center at Reports > Usage. Alternatively, you can use the Microsoft Graph API or PowerShell. For example, to get Teams user activity via Graph API:

GET https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityUserDetail(period='D7')

This returns a CSV with user-level data for the last 7 days.

Using PowerShell with the Exchange Online module:

Get-MailboxActivityReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)

To check who can view reports, verify role assignments in Azure AD:

Get-AzureADDirectoryRole | Where-Object {$_.DisplayName -eq "Reports Reader"} | Get-AzureADDirectoryRoleMember

Usage reports are closely tied to: - Microsoft 365 admin center: The primary UI for viewing reports. - Microsoft Graph: The API that powers data extraction for custom dashboards. - Power BI: You can connect usage report data to Power BI for advanced visualization using pre-built templates. - Azure AD: User identities and licenses are the foundation; reports show activity per user. - Microsoft 365 Adoption Score: A separate feature that uses usage data to provide organizational productivity insights, but it's not the same as raw usage reports. Adoption Score includes additional metrics like network connectivity and communication trends.

A multinational corporation with 10,000 employees uses Microsoft 365 E5 licenses. The IT director suspects many licenses are underutilized. Using the Microsoft 365 Active Users Report (under Reports > Usage > Active Users), the admin filters by product (e.g., Teams) and sees that only 6,000 users have been active in Teams in the last 30 days. Further drill-down into the Inactive Users Report reveals 1,200 users who have not used any M365 service for over 90 days. The admin creates a PowerShell script to automatically remove licenses from these users after a grace period, saving $240,000 per year (assuming $20/user/month). The challenge: the report's 24-48 hour latency means a user who was active yesterday might still appear inactive if the report hasn't updated. The admin compensates by setting the inactivity threshold to 100 days to avoid premature removal.

A company rolls out a new Microsoft Teams feature—breakout rooms. The change management team wants to measure adoption. They use the Teams User Activity Report to get a baseline of meeting counts before the rollout. After training, they monitor the report weekly. They see that the number of meetings with breakout rooms (a separate metric) increased by 30% in the first month. However, they notice that the report only shows data for the last 28 days. To track long-term trends, they use Microsoft Graph API to export data daily into a Power BI dashboard. Misconfiguration: The admin initially gave the change manager Global Admin access to view reports, which was excessive. They later assigned the Reports Reader role, which is sufficient and more secure.

A security analyst notices a sudden spike in external sharing of SharePoint files. They use the SharePoint Site Usage Report to see which sites have the most activity. Then they drill into the File Activity Report to identify which users are sharing externally. The report shows the number of files shared externally per user. They discover that a marketing user has shared a confidential document with a vendor. The report's data is 2 days old, but it still helps the analyst narrow down the investigation. They then use the Unified Audit Log to get real-time details. The lesson: usage reports are for trends, not real-time forensics.