📧 Exchange Online Course · Final Module 7 of 7
Reports, Insights & Troubleshoot
MS-203 Exam Alignment
MS-203
Monitor, report, and troubleshoot Exchange Online: interpret mail flow reports (auto-forwarded messages, inbound TLS, spam and malware), use EAC Insights for proactive recommendations, run standard and extended Message Trace, use the Remote Connectivity Analyzer, and search the Admin Audit Log.
- Identify what each mail flow report measures and when each is clinically useful for troubleshooting
- Know standard Message Trace (10-day window) vs extended Message Trace (90 days) and when each applies
- Use Remote Connectivity Analyzer (testconnectivity.microsoft.com) to diagnose Autodiscover and mail flow failures
- Search the Admin Audit Log with Search-AdminAuditLog — date range, cmdlet filter, user scope
- Understand EAC Insights and what triggers the auto-forwarding insight
Exam Tip: For any troubleshooting scenario, know the right tool: email not delivered → Message Trace. Outlook won't connect → Remote Connectivity Analyzer. Admin changed something and you don't know who → Admin Audit Log. Email is being forwarded externally without authorisation → Auto-forwarded messages report + transport rule to block. These mappings appear directly in MS-203 questions.
The EAC Reports section and the Admin Audit Log are your primary tools for understanding what is happening (and what has happened) in Exchange Online. This final module covers all key reports, the Message Trace tool, the Remote Connectivity Analyzer for external testing, and the audit log for change tracking.
📊 Mail Flow Reports
Mail flow reports are found in EAC → Reports → Mail flow. They are aggregated, time-range-filtered views of what is passing through Exchange Online Protection (EOP). They update with a delay of approximately 24–48 hours.
EAC › Reports › Mail flow
🏠 Home
👤 Recipients
📧 Mail flow
🔑 Roles
🔄 Migration
📊 Reports
Mail flow
Message trace
Mail flow reports
Auto-forwarded messages
Shows messages auto-forwarded to external addresses — essential for detecting data exfiltration and misconfigured mailboxes
Shows messages auto-forwarded to external addresses — essential for detecting data exfiltration and misconfigured mailboxes
Inbound messages with TLS breakdown
Shows inbound email volume split by TLS version (TLS 1.0, 1.1, 1.2, 1.3) and unencrypted — identifies insecure sender connections
Shows inbound email volume split by TLS version (TLS 1.0, 1.1, 1.2, 1.3) and unencrypted — identifies insecure sender connections
Spam detections
Volume and trends of messages classified as spam by EOP — useful for tuning anti-spam policies and identifying spam campaigns
Volume and trends of messages classified as spam by EOP — useful for tuning anti-spam policies and identifying spam campaigns
Malware detections in email
Attachments and URLs blocked by EOP anti-malware — shows threat volume, top malware families, and affected users
Attachments and URLs blocked by EOP anti-malware — shows threat volume, top malware families, and affected users
| Report | What It Shows | Primary Use Case |
|---|---|---|
| Auto-forwarded messages | External auto-forwarding rules active across the tenant — who is forwarding, to where, and message volume | Detecting data exfiltration, compromised accounts forwarding email externally, and enforcing no-forwarding policies |
| Inbound messages with TLS | Inbound email volume broken down by TLS version (1.0, 1.1, 1.2, 1.3) and non-TLS (unencrypted) | Identifying partner or customer mail servers using deprecated TLS versions before enforcing TLS 1.2 minimum on connectors |
| Outbound messages with TLS | Same breakdown for outbound email — how your messages leave Exchange Online | Verifying outbound TLS enforcement; confirming connector-enforced TLS is working correctly |
| Spam detections | Volume of messages classified as spam by EOP over time, with top spam sources | Identifying spam campaign spikes, tuning bulk threshold (BCL) settings, reviewing false positive/negative rates |
| Malware detections in email | Attachments and URLs blocked by EOP anti-malware — volume, top malware families, affected recipients | Understanding threat landscape, identifying targeted users, reporting to security teams |
| Compromised users | Accounts flagged by Microsoft as likely compromised based on suspicious outbound sending patterns | Identifying and remediating hijacked accounts before they send further spam or phishing |
💡 EAC Insights
EAC Insights appear on the EAC Home dashboard and the Insights panel — they are AI-driven proactive recommendations generated by Microsoft based on detected anomalies or configuration issues in your tenant.
💡 How Insights Work
Insights monitor your tenant configuration and mail flow patterns in the background. When a potential issue or improvement opportunity is detected, an insight card appears. Each insight links directly to the fix or configuration page. Common insights include:
- Auto-forwarding insight — Triggers when Microsoft detects mailboxes auto-forwarding to external addresses, especially if no transport rule is blocking this. The insight links you to the auto-forwarded messages report and the transport rule configuration to block external auto-forwarding.
- DKIM configuration insight — Appears when DKIM signing is not enabled for your accepted domains.
- Connector TLS insight — Fires when a partner connector is configured to accept email without TLS enforcement.
- Outbound spam insight — Generated when an account is sending suspicious volume outbound, suggesting possible compromise.
🔍 Message Trace
Message Trace is the primary tool for tracking a specific email's journey through Exchange Online — from the moment it was received (or submitted for sending) to final delivery or failure. It answers the question: "What happened to that email?"
EAC › Reports › Message trace
| Standard Message Trace | Extended Message Trace | |
|---|---|---|
| Time window | Last 10 days | Up to 90 days |
| Results | Displayed inline in the EAC immediately | Delivered as a downloadable CSV report (takes minutes to hours) |
| Detail level | Per-message summary — status, recipient, timestamp, delivery status | Full per-hop routing details — each Exchange server, each processing step, timestamps per hop |
| When to use | Recent delivery issues — "Where is the email I sent yesterday?" | Older issues or compliance investigations — "Was that phishing email received 6 weeks ago?" |
| How to access | EAC → Reports → Message trace → Run trace | EAC → Reports → Message trace → Downloadable reports tab |
⚠️ Key Message Trace Status Values
- Delivered — Message was delivered to the recipient's mailbox
- FilteredAsSpam — Message was classified as spam and sent to the Junk Email folder (or quarantine)
- Quarantined — Held in EOP quarantine — admin or user must release it
- Failed — Permanent delivery failure — check the detail for the SMTP error code and reason
- Pending — In the delivery queue — temporary issue, Exchange will retry
- Expanded — Message was sent to a distribution group and expanded to individual recipients
PowerShell — Message Trace
Connect-ExchangeOnline # Standard trace — messages from a sender over the last 48 hours Get-MessageTrace -SenderAddress sender@contoso.com -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) | Select-Object Received,SenderAddress,RecipientAddress,Subject,Status,MessageId # Trace for a specific recipient Get-MessageTrace -RecipientAddress user@techcareers.in -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Select-Object Received,SenderAddress,Subject,Status # Full hop-by-hop detail for a specific message Get-MessageTraceDetail -MessageTraceId "[MessageTraceId]" -RecipientAddress user@techcareers.in | Select-Object Date,Event,Action,Detail | Format-Table -AutoSize # Extended trace (older than 10 days) — submitted as async report request Start-HistoricalSearch -ReportTitle "Phishing-Investigation-June" -StartDate 2025-06-01 -EndDate 2025-06-30 -ReportType MessageTrace -SenderAddress phish@badactor.com
🌐 Remote Connectivity Analyzer
The Remote Connectivity Analyzer at testconnectivity.microsoft.com is a Microsoft-hosted external testing tool that simulates connections to your Exchange Online environment from outside. It tests Autodiscover, ActiveSync, Outlook Anywhere, SMTP, and other services — from Microsoft's own infrastructure, replicating what an end-user or external mail server would experience.
| Test | What It Checks | Use Case |
|---|---|---|
| Outlook Autodiscover | Whether Autodiscover resolves correctly for a given email address — checks DNS, redirect chains, and the XML response | Outlook not connecting automatically; new user profiles failing to set up |
| Exchange ActiveSync | Whether a mobile device can reach the ActiveSync endpoint and authenticate | Mobile phones not syncing; testing before deploying a Mobile Device Mailbox Policy |
| Inbound SMTP Email | Whether external mail servers can deliver email to your domain — checks MX records, banner, TLS, and response codes | External senders reporting delivery failures to your domain |
| Outbound SMTP | Tests whether your Exchange Online sends email correctly and DKIM/SPF are passing | Your outbound email being rejected or landing in external spam folders |
| Microsoft 365 General | Connectivity and authentication to Microsoft 365 services broadly | General connectivity issues for a tenant |
✅ When to Use Remote Connectivity Analyzer vs Message Trace
- Use Message Trace when you know a specific email was sent and want to know what happened to it (delivery, filtering, quarantine)
- Use Remote Connectivity Analyzer when you need to diagnose a connectivity problem — Autodiscover not working, ActiveSync not connecting, or external mail not reaching your domain. It tests the infrastructure path, not individual messages
📋 Admin Audit Log
The Admin Audit Log records all Exchange Online administrative actions — every cmdlet run by any administrator with a role group assignment. It answers: "Who changed this setting, and when?" It stores logs for 90 days by default.
PowerShell — Search Admin Audit Log
Connect-ExchangeOnline # All admin activity in the last 7 days Search-AdminAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Select-Object RunDate,Caller,CmdletName,ObjectModified | Format-Table -AutoSize # Who changed transport rules in the last 30 days Search-AdminAuditLog -Cmdlets "New-TransportRule","Set-TransportRule","Remove-TransportRule" -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Select-Object RunDate,Caller,CmdletName,ObjectModified,CmdletParameters # All changes made by a specific admin Search-AdminAuditLog -UserIds admin@techcareers.in -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Select-Object RunDate,CmdletName,ObjectModified | Format-Table -AutoSize # Who deleted a mailbox Search-AdminAuditLog -Cmdlets "Remove-Mailbox" -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) | Select-Object RunDate,Caller,ObjectModified
⚠️ Admin Audit Log vs Microsoft Purview Audit
The Exchange Admin Audit Log (Search-AdminAuditLog) covers Exchange Online administrative cmdlet activity — who ran Exchange PowerShell commands. The Microsoft Purview Unified Audit Log (Search-UnifiedAuditLog) covers all Microsoft 365 workloads including SharePoint, Teams, OneDrive, Azure AD, and Exchange user activity. For compliance investigations spanning multiple M365 services, Purview Unified Audit is the right tool. For Exchange-specific admin changes, Search-AdminAuditLog is faster and more targeted.
💡 Best Practices
- Check the Auto-forwarded messages report monthly — external auto-forwarding is a primary data exfiltration vector and often set up by compromised accounts, not intentional users
- Use Message Trace as the first step for any user complaint about missing or undelivered email — it takes 2 minutes and immediately tells you whether Exchange received the message at all
- Run Remote Connectivity Analyzer when Autodiscover problems are reported — it tests from outside your network, which internal ping/curl tests cannot replicate
- Review the Admin Audit Log after any unexpected configuration change — it provides a 90-day history of every Exchange admin cmdlet with caller identity, timestamp, and parameters
- Set up a transport rule to block external auto-forwarding if the auto-forwarded messages report shows unexpected external forwarding — this is the most common security recommendation generated by EAC Insights
🎓 Interview Q&A
Q: A user reports they sent an important email to a client 3 days ago and the client never received it. What is the first tool you use?
Message Trace in the EAC (Reports → Message trace). Run a standard trace using the sender and recipient addresses with the appropriate date range. The trace will show whether Exchange Online ever received the message, whether it was delivered, filtered as spam, quarantined, or failed with an error. If the status is FilteredAsSpam or Quarantined, you know the EOP filtered it. If it shows Delivered, the issue is on the recipient's side. If it shows Failed, the SMTP error code in the detail tells you why.
Q: The auto-forwarded messages report shows several mailboxes forwarding email to external Gmail addresses. What does this mean and how do you stop it?
External auto-forwarding means those mailboxes have Inbox rules or mailbox forwarding configured to send copies of all received email to external addresses. This is a data exfiltration risk — it could be deliberate by the user, or more commonly, it indicates account compromise (phishing attackers commonly set up forwarding to monitor a victim's email). Immediate steps: (1) Confirm whether the forwarding was set up intentionally with the user/manager. (2) If unauthorised, remove the forwarding rule (Set-Mailbox -ForwardingSmtpAddress $null / check Inbox rules via Get-InboxRule). (3) If compromised, reset the password and revoke sessions. (4) Create a transport rule to block all external auto-forwarding: condition "Message type = Auto-forward", action "Reject the message".
Q: A user's Outlook won't automatically configure their profile when they enter their email address. What tool do you use to diagnose this?
Use the Remote Connectivity Analyzer at testconnectivity.microsoft.com — specifically the Outlook Autodiscover test. Enter the user's email address and credentials. The tool tests the Autodiscover DNS record, follows any redirect chains, and validates the final Autodiscover XML response. The results show exactly which step fails — DNS lookup, HTTP redirect, SSL certificate issue, or a malformed XML response — giving you the root cause without needing to be on the user's machine or network.
Q: A transport rule that was blocking a specific sender has disappeared. How do you find out who deleted it and when?
Search the Admin Audit Log using:
Search-AdminAuditLog -Cmdlets "Remove-TransportRule" -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date). The results show the RunDate (when it was deleted), the Caller (which admin account ran the cmdlet), and the ObjectModified (the name of the deleted rule). The Admin Audit Log retains 90 days of activity and logs every Exchange Online administrative cmdlet — including who deleted, created, or modified any object.Q: What is the difference between standard Message Trace and extended (historical) Message Trace?
Standard Message Trace covers the last 10 days and displays results immediately in the EAC. It provides per-message status including delivery, filtering, and failure reasons. Extended (historical) Message Trace covers up to 90 days but is submitted as an asynchronous report request — results are delivered as a downloadable CSV file (Start-HistoricalSearch in PowerShell). Use standard for recent issues; use extended for compliance investigations, audit requests, or troubleshooting issues that occurred more than 10 days ago.
🎯 MS-203 Mock Test
Module 7 — Reports, Insights & Troubleshoot
Question 1 of 5
A user reports that an email they sent to an external client 5 days ago was never received. The client confirms they have not seen it in spam either. What is the first tool you should use to investigate?
✅ Correct answer: B. Message Trace is the correct first step for any missing email investigation. It shows the exact journey of a specific message — whether Exchange received it, filtered it, quarantined it, delivered it, or failed to deliver it. The standard trace covers 10 days so a 5-day-old message is within scope. The trace result (Delivered, FilteredAsSpam, Failed etc.) immediately directs the next troubleshooting step.
Question 2 of 5
A Message Trace shows the status "FilteredAsSpam" for a legitimate email a partner sent to your organisation. What does this mean and what is the correct action?
✅ Correct answer: D. FilteredAsSpam means EOP's spam filter classified the message as junk. Depending on the anti-spam policy settings, it was either delivered to the Junk Email folder or held in quarantine. The recipient can check their Junk folder; admins can check the quarantine in Microsoft Defender / EAC. For legitimate senders, add the sender's domain or IP to the anti-spam policy allow list, or use a connection filter to bypass spam filtering.
Question 3 of 5
Users in your organisation are reporting that Outlook does not automatically configure when they enter their email address — they have to configure it manually. Which tool should you use to diagnose this?
✅ Correct answer: C. The Remote Connectivity Analyzer (testconnectivity.microsoft.com) Outlook Autodiscover test simulates the Autodiscover process from outside your network — it checks DNS records, follows redirect chains, validates the SSL certificate, and examines the XML response. This immediately shows which step fails and why. Message Trace (A) is for email delivery, not Outlook connectivity. The Admin Audit Log (D) would only help if an admin had changed Autodiscover config.
Question 4 of 5
The EAC Auto-forwarded messages report shows that 12 mailboxes have active forwarding rules sending email to external addresses. What is the most appropriate security action?
✅ Correct answer: A. A transport rule with condition "Message type is Auto-forward" and action "Reject the message with explanation" blocks external auto-forwarding at the mail flow level — it applies instantly to all mailboxes and cannot be bypassed by individual user settings. This is the Microsoft-recommended approach and is the action EAC Insights commonly recommends when the auto-forwarding insight fires. Investigate the 12 mailboxes separately to determine whether they were compromised.
Question 5 of 5
A compliance officer needs to determine who deleted a transport rule 6 weeks ago. Which PowerShell cmdlet would you use and which parameter limits the search to that action?
✅ Correct answer: C. Search-AdminAuditLog with -Cmdlets "Remove-TransportRule" and an appropriate -StartDate/-EndDate searches the Exchange Admin Audit Log for that specific cmdlet. The log retains 90 days of activity — 6 weeks is within that window. Each result shows the RunDate, the Caller (admin UPN), and the ObjectModified (rule name). Get-MessageTrace (A) is for email tracking, not admin actions. Search-UnifiedAuditLog (B) would also work but is broader; for Exchange-only admin queries, Search-AdminAuditLog is more targeted.
🔒
This module is lockedComplete Module 6 and pass its mock test to unlock this final module.