Mail Protection Reports for Office 365

We all know about spams and malware and we absolutely hate it. If you are an Office 365 administrator of your Organization, you would certainly want to regularly monitor the amount of spam mails received by your employees over a period of time. Office 365 Admin center provides you interactive protection reports for mails up to 90 days.

Office 365 mail protection options

Protection Reports:

The following protection reports are available in the Office 365 Admin Center:

  • Top senders and recipients
  • Top malware for mail
  • Malware detections
  • Spam detections
  • Sent and received mail
  • Spoof mail report

Here is a quick overview of all the available reports:



Top senders and recipients There are some more reports available in this category:

  • Top mail recipients – Shows you the top 10 recipients of your Organization based on the mail count
  • Top mail senders – Shows you the top 10 senders of your Organization based on the mail count
  • Top spam recipients – Shows you the top 10 spam recipients of your Organization
  • Top malware recipients – Shows you the top 10 malware recipients of your Organization
Top malware for mail Shows you the top 10 malwares in both sent and received mails
Malware detections Shows details about each and every mails detected as malware in both sent and received mails
Spam detections Shows details about the spam detected in sent and received mails based on the spam type:

  • Content filtered – mails detected as spam based on the message or body content
  • SMTP blocked – mails detected and blocked as spam based on the sender / recipient mail address
  • IP blocked – mails detected and blocked as spam based on the reputation of the IP address
Sent and received mail Shows details about mails based on the traffic type of the mails:

  • Good mail – mails that were not identified as spam or malware
  • Spam – mails that were identified as spam
  • Malware – mails that contained malware

You can filter the report to view details for a specific sender or recipient. You can also filter data for a specific domain.

Spoof mail report These are mails sent to your organization by sender who appears to be the part of your Organization but actual sender is someone else. This is also called as Insider Spoofing. While some Organization use it intentionally (say when multiple users, used to send mails from a common Shared mailbox), some of the spoofing are considered as malicious.

The following details can be obtained from this report.

  • Spoofed sender – the mail address shown actually in the mail
  • True sender – the actual sender who has sent the mail
  • Sender IP – IP address of the sender
  • Event type – whether the mail is marked as spam or not

Before you run these reports, you need to be assigned ‘global administrator’ role assigned for the account you are trying to access with. Here is how you assign the Global Administrator role:

  • Sign in to Office 365 with your work or school account.
  • Go to the Office 365 admin center.
  • Click Users.
  • On the Active users page, choose the user whose administrator role you want to change.
  • Next to Roles, click Edit.
  • Select ‘Global Administrator’ from the list of user roles and click ‘Save’.

View Mail Protection Reports:

view send and received mail reports

Date range for any report under Mail Protection can be up to 90 days. You can also filter data using the series available next to the chart, to view summary for the specific mail types.

view send and received mail reports with filter

Detailed data will be available for some of the reports types. When you click on the data points in the chart, the corresponding details like date the message was sent or received, sender and recipient address, message id and subject of the message will be shown in a table below the chart.

By default, detailed information will be shown for mails sent or received in the last 7 days. Mails older than 7 days is available as a separate download.

mails older than seven days

Message older than 7 days will be shown, highlighted with gray background. When you click a data point in this region, you will see a link called “Request this report”.  When you click on this link, a filter dialog will be shown as below,

request mail reports

The following parameters can be specified for filtering:

  • Start and End date – Date range for the reporting data.
  • Delivery status – Whether the mails have failed or delivered
  • Message ID
  • Client IP address
  • E-mail address to e-mail the generated report

Once you click the Submit button, a report request will be submitted and the generated report will be mailed to the given address once the generation process is completed.


Mail Protection is much important when you move to a cloud environment like Office 365. It requires continuous monitoring and getting reports by utilizing proper tools to address these spam mails and filter it. While all these Office 365 mails may be monitored and reported using the Office 365 Admin Center, automated third party tools save you a lot of time and effort by providing sophisticated features to address such issues. One such tool is the Vyapin Office 365 Management Suite. Download free trial now!