6. Service Life CycleScenarioEXOLYOSPOOffice365 (suite wide) BuyProvisioning Licenses Storage ConsumeDevice – Software Device – Connections User - Email activity User - Docs activity User - Meetings activity User - External Sharing

8. Portal Definition Number of active and inactive mailboxes over time. A mailbox is considered inactive if a user has not logged in for more than 30 days. Number of inactive mailboxes are grouped by the number of days the user has not logged in Technical Definition – Active Mailbox Mailbox is connected Mailbox has been logged into in past 30 days (from store) OR Mailbox has been created in past 30 days (from AD) Technical Definition – InActive Mailbox Mailbox is connected Mailbox has not been logged into in past 30 days (from store) Mailbox was created more than 30 days ago (from AD) Mailbox Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API StaleMailbox StaleMailboxDetail CMDLets Get-StaleMailboxReport Get-StaleMailboxDetailReport Note! Inactive Mailbox here does not refer to the “inactive” mailbox state as defined by ligation hold. Yes, we know this is very confusing.

9. Portal Definition Shows the number of total number of mailboxes, inactive mailboxes, mailboxes exceeding their storage quota, and mailboxes using less than 25% of their storage limit. Technical Definition – Total Mailbox Source (AD) All connected Mailboxes Technical Definition – InActive Mailbox Mailbox is connected Mailbox has not been logged into in past 30 days (from store) Mailbox was created more than 30 days ago (from AD) Technical Definition – Exceeds Storage Limit Source AD (MBX limits) Source Store (MBX size) Over limit if MBX total item size is over IssueWarningQuota Technical Definition – < 25% storage Source AD (MBX limits) Source Store (MBX size) < 25% of ProhibitSendReceiveQuota Mailbox Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailboxUsage MailboxUsageDetail CMDLets Get-MailboxUsageReport Get-MailboxUsageDetailReport

10. Portal Definition Shows the number of mailbox connections made over time, grouped by connection types. Technical Definition – Protocols MAPI, OWA, EAS, EWS, IMAP, POP3 Technical Definition – Protocol Count Café (CAS) logs for each protocol Distinct MBX accessed per day Aggregated daily Mailbox Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API ConnectionByClientType (daily, weekly, monthly, yearly) ConnectionbyClientTypeDetail CMDLets Get-ConnectionByClientTypeReport Get-ConnectionByClientTypeDetailReport

11. Portal Definition Shows the number of active mailboxes, and the number of mailboxes created and deleted. A mailbox is considered active if a user has accessed it at least once in the last 30 days. Technical Definition – Total Active Mailbox Mailbox is connected Mailbox has been logged into in past 30 days (from store) OR Mailbox has been created in past 30 days (from AD) Technical Definition –Mailbox Created Source (AD) Mailbox was created or reconnected in a day Does not count inter-day soft-deletes/restores Aggregated daily Technical Definition –Mailbox Deleted Source (AD) Mailbox was soft deleted or removed in a day Does not count inter-day soft-deletes/restores Aggregated daily Mailbox Level Details – Not Available Summary Via Reporting Web Service and CMDLets Web Service/ODATA API MailBoxActivity (daily, weekly, monthly, yearly) CMDLets Get-MailboxActivityReport

12. Portal Definition Shows the number of groups created and deleted. Technical Definition – Group Created Source (AD) Groups created daily (WhenCreated==Today) Does not currently include DDGs (planned) Aggregated daily. Technical Definition –Mailbox Deleted Source (AD) Groups deleted daily (WhenDeleted==Today) Does not currently include DDGs (planned) Aggregated Daily. Group Level Details – Not Available Summary Via Reporting Web Service and CMDLets Web Service/ODATA API GroupActivity (daily, weekly, monthly, yearly) CMDLets Get-GroupActivityReport

14. Portal Definition Shows received mail based on traffic type Technical Definitions Good Mail - messages that were received and not identified as spam or malware Spam - messages identified as spam Malware - messages that contained malware Transport rules - messages that matched at least one rule DLP - messages that matched at least one DLP policy Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventTypes GoodMail Malware TransportRuleHits SpamEnvelopeBlock SpamIPBlock SpamContentFiltered

15. Portal Definition Shows what spam was detected, grouped by spam filtering type. Technical Definitions SMTP Blocked- Sender and recipient filtering IP Blocked -The reputation of the connecting IP address is evaluated by means of lists from partners and third- party providers Content filtered - content is checked for terminology or properties common to spam Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventTypes SpamEnvelopeBlock SpamIPBlock SpamContentFiltered

16. Portal Definition Shows the number of malware detections in received mail, before the malware action was applied Technical Definitions Viruses infect other programs and data, and they spread throughout your computer looking for programs to infect. Spyware refers to malware that gathers your personal information, such as sign- in information and personal data, and sends it back to its author. Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventType Malware

17. Portal Definition Shows the number of transport rule matches in received mail, grouped by severity. Technical Definitions Severity is defined by the admin for each transport rule created Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventType TransportRuleHits

18. Portal Definition Shows the number of transport rule matches in received mail, grouped by severity. Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventType DLPPolicyHits DLPPolicyOverride DLPPolicyFalsePositive Technical Definitions Policy Matches: daily count of DLP policies that were matched. Overrides: daily count of the DLP Policies that were overridden by the user. False Positive: Daily count of DLP Policies that were reported as False Positive

19. Portal Definition Shows the number of DLP rule matches in received mail, grouped by severity. Technical Definitions Severity is defined by the admin for each transport rule created Mail Level Details Via Reporting Web Service and CMDLets Web Service/ODATA API MailTraffic CMDLets Get-MailTraffic EventType DLPPolicyRuleHits

44. SessionTitleTimingRoom SPR.202Encryption in ExchangeTue 10:45 AM - 12:00 PMBallroom E SPR.201 Eliminate the Regulatory Compliance NightmareTue 9:00 AM-10:15 AMMR 19ab SPR.UN.305 Exchange Online Protection: Notes from the field Wed 10:15 AM – 11:30 AMBallroom G SPR.UN.304 Experts Unplugged: EOP & Encryption Wed 8:30-9:45 AM Wed 1:00-2:15 PM MR 18d MR 17b SPR.401 Extending Data Loss Prevention For Your BusinessWed 4:45 PM- 6:00 PMMR 18bc SPR.203 Protect your Organization with Exchange Online Protection (EOP)Mon 4:30 PM - 5:45 PMMR 18bc SPR.301 So how does Microsoft handle my spam?Tue 4:45 PM – 6:00 PMMR 19ab SPR.401 Using Connectors & Mail RoutingWed 2:45 PM - 4:00 PMMR 18bc

45. SessionTitleTimingRoom SPR.202Encryption in ExchangeTue 10:45 AM - 12:00 PMBallroom E ARC.304 Exchange Server 2013 Transport ArchitectureTues 9:00 AM - 10:15 AMBallroom F EDC.302 Advanced Data Loss Prevention in ExchangeTues 1:30 PM-2:45 PMBallroom F EDC.UN.301 Experts Unplugged: Data Loss Prevention Tue 3:00 PM-4:15 PM Wed 10:15 AM-11:30 AM MR 18d MR 13ab EDC.204 Data Loss Prevention in Exchange, Outlook, OWAMon 2:45 Pm-4:00PMMR 18bc MNG.304 Reporting On O365 Mail flow and Mailbox DataWed 1:00 PM-2:15 PMMR 17a MNG.301Exchange Admin Center - getting administration done Wed 10:15 AM - 11:30 AMMR 18bc