need to check the total number of mail, a user has sent from the domain or tenant

Megha Devrani 0 Reputation points
2026-10-07T11:09:19.4233333+00:00

As we are facing issue where , admin has no clear view from which id bulk mailing or number of mail are shooting, so he can apply restiction to sending limit to the user

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-07T11:09:34.65+00:00

    To identify which mailbox is sending high volumes and to monitor tenant-level outbound usage in Exchange Online, use these built-in reports and tools:

    1. Check tenant external sending volume
      • Go to Exchange admin center → Reports → Mail flow.
      • Open Tenant Outbound External Recipients.
      • This report shows the organization’s Tenant External Recipient Rate Limit (TERRL) usage.
      • This helps confirm whether the tenant is approaching or exceeding the daily external recipient limit.
    2. Trace outbound messages
      • Use Message trace to track individual outbound messages and identify delivery failures.
      • This is the best option to investigate which sender is generating bulk outbound mail.
    3. Review alert policies
      • In the Microsoft Defender portal → Alert policy, review these built-in alerts:
        • Email sending limit exceeded
        • Suspicious email sending patterns detected
        • User restricted from sending email
      • These alerts notify admins when a user exceeds limits or shows suspicious outbound behavior.
    4. Check if a user is already blocked
      • In the Microsoft Defender portal → Restricted entities page, review users who were blocked from sending.
      • A blocked user can appear there when Exchange Online detects spam-like behavior or outbound sending limit violations.
    5. Apply restrictions through outbound spam policies
      • Configure outbound spam policies with appropriate per-hour and daily limits and notifications.
      • This is the supported way to control sending behavior and receive alerts before users are blocked.
    6. Monitor with PowerShell if needed
      • For programmatic monitoring, use these Exchange Online PowerShell cmdlets:
        • Get-MailDetailTransportRuleReport
        • Get-MailTrafficSummaryReport

    Useful limit values when reviewing user activity:

    • Recipient rate limit: 10,000 recipients per day per mailbox.
    • Message rate limit: 30 messages per minute per mailbox.
    • Recipient limit per message: 500 recipients by default, customizable up to 1000.

    If the goal is to find exactly which user is sending bulk mail, start with Message trace for sender-level investigation, then use alert policies and Restricted entities to identify accounts that already exceeded limits or were blocked.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Aetherin 3,005 Reputation points Independent Advisor
    2026-10-07T11:33:46.3233333+00:00

    Hi @Megha Devrani,

    For a per-user report covering the last 24 hours, the most suitable option is Message Trace in Exchange Online PowerShell. Microsoft provides the cmdlet syntax and examples in the following documentation: Get-MessageTraceV2.

    You can retrieve message trace data for the last 24 hours, group the results by sender, and export them to a CSV file. When calculating the number of messages, use unique MessageTraceId values to help avoid counting the same message multiple times when it was sent to multiple recipients.

    Please note that Get-MessageTraceV2 returns a maximum of 5,000 results per query. For tenants with higher mail volume, divide the 24-hour period into smaller time ranges to ensure the report is complete.

    Alternatively, the admin can go to Exchange admin center > Mail flow > Message trace > Start a trace, select the last 24 hours, leave the sender field blank to search the whole tenant, and export the results. You can also refer: Message trace in the Exchange admin center

    User's image

    I hope this answer provides helpful documentation for generating the report and tracking email-sending activity across your tenant. If you need any further clarification, please feel free to comment below.

    Thank you so much for taking the time.

    If the answer is helpful, please kindly click "Yes" button below. If you have extra questions about this answer, please click "Comment".    

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.