Provides detailed logs on email activity per user, such as number of emails read, sent, received, and interactions with the mailbox, which is often used for monitoring usage trends or security audits.

Select

The cmdlet uses the Microsoft Exchange API to process WHERE clause conditions built with the following columns and operators:

• Period supports the '=' operator.
• Date supports the '=' operator.

The rest of the filter is executed client-side in the cmdlet.

At a minimum, a Date or Period column is required to get the report data. By default, the driver makes a request of the period as D7 if no filter is specified.

For example, the following query is processed server-side:

SELECT * FROM EmailActivityUserDetail WHERE Period = 'D7' 
SELECT * FROM EmailActivityUserDetail WHERE Date = '2023-04-19' 

Columns

Name	Type	Description
ReportRefreshDate	Date	The date on which the email activity report was last refreshed. This reflects the most recent point in time for which activity data is available.
UserPrincipalName	String	The unique user principal name (UPN) of the Exchange account, typically in the form of an email address, used to identify the user in the tenant.
DisplayName	String	The display name of the user as it appears in the Exchange environment and associated reports.
IsDeleted	Boolean	Indicates whether the user's account was deleted at the time of the report. A value of true means the account no longer exists in the tenant.
DeletedDate	Date	The date on which the user account was deleted, if applicable. Null if the account is active.
LastActivityDate	Date	The most recent date on which the user performed any email-related activity, such as sending, receiving, or reading a message.
SendCount	Integer	The total number of email messages the user sent during the reporting period.
ReceiveCount	Integer	The total number of email messages the user received during the reporting period.
ReadCount	Integer	The number of email messages the user opened and read during the reporting period, representing engagement with received content.
MeetingCreatedCount	Integer	The number of meetings the user created during the reporting period using calendar functionality.
MeetingInteractedCount	Integer	The number of meetings the user interacted with, such as joining, accepting, or responding to invitations, during the reporting period.
AssignedProducts	String	A comma-separated list of Microsoft 365 products assigned to the user, such as Exchange Online, SharePoint Online, or Teams.
ReportPeriod	Integer	The duration, in days, covered by the report. Common values include 7, 30, 90, or 180 days depending on the reporting scope.

Pseudo-Columns

Pseudo column fields are used in the WHERE clause of SELECT statements and offer a more granular control over the tuples that are returned from the data source.

Name	Type	Description
Period	String	Defines the aggregation window for the report. Supported values are D7, D30, D90, and D180, which represent 7, 30, 90, and 180 days respectively. The allowed values are D7, D30, D90, D180. The default value is D7.
Date	Date	The specific date for which user activity is retrieved. The value must be in YYYY-MM-DD format and must fall within the last 30 days, as only recent activity is available.