It looks like the good folks at Microsoft have updated the output of the Get-MailboxStatistics cmdlet with few additional properties. Here’s the full list:
LastEmailTime : 01/02/2019 15:17:05 LastContactsTime : 13/09/2018 18:55:35 LastCalendarTime : 25/01/2019 18:48:09 LastTasksTime : 21/01/2019 17:13:13 LastFileTime : 01/02/2019 21:55:48 LastProfileTime : LastInteractionTime : 01/02/2019 15:17:05 LastUserAccessTime : LastUserActionTime : 01/02/2019 15:17:05 LastUserActionUpdateTime : 02/02/2019 01:52:04
Since there is no mention in the documentation for any of there, we can make some educated guesses as to what each property represents. For example, the LastTasksTime seems to correspond to the date/time at which I last updated a task item in my mailbox, and in fact seems to be correct. On the other hand, properties such LastEmailTime or LastActionTime don’t seem to correspond to the actual time such operations were performed. And since they all have a similar value, we can guess that all of them are being updated by some background process on a regular schedule, which seems to introduce few days delay.
And that’s pretty much all I know about them at this time. I’ve probed Microsoft for more details, and should they share them or publish an article on the changes, I will make sure to circle back to this. It’s also worth noting that none of these properties seem to be available on-premises, at least not on Exchange 2019 RTM.
EDIT 15/05/2019: After toying around a bit more with this and getting additional information from Microsoft, we now have a better understanding of these properties. First of all, as suspected, they are not being updated in real time. Instead, a background assistant processed the mailbox every few days, similar to the way the MFA assistant processes items subject to retention. The SLA for the assistant is 3 days, but you can expect to see the occasional delays.
We now know that the LastUserActionTime should reflect the timestamp of the last action performed by the user, across the different workloads (Email, Contacts, Calendar, Tasks). In the example above, LastUserActionTime matches the value of LastEmailTime, signaling this is the last action I’ve performed in my mailbox. It does NOT seem to reflect on the LastFileTime property, which I guess is treated differently because it’s technically not an email workload. However, the LastUserActionWorkloadAggregateTime property reflects the ‘aggregate’ between all the email and non-email workloads, thus giving you the ‘true’ last user action timestamp.
The LastUserActionUpdateTime shows when the mailbox was last processed, so you shouldn’t expect to see any update earlier than its value. And it also gives you a clue about when the next processing should happen.
LastInteractionTime seems to be updated independently of the other parameters, near real-time, so it seems to be the best way to determine the answer to “when was this user last active” question. Unfortunately, the value of this property seems to be updated by other background assistants running against the mailbox, so it might not always give you the correct data.
Some additional properties have appeared as well. LastModernGroupsTime should be populated for any Office 365 group mailboxes you have, although the value is currently empty for any object I’ve checked in my tenant.
11 thoughts on “New properties added to Get-MailboxStatistics output”
Is there any way to use these attributes reliably to report on unused shared mailboxes? If a single user has a shared mailbox auto mapped, it looks like it updates LastInteractionTime irrespective if they read email or send email from that mailbox.
I suppose accessing the mailbox, even as delegate, updates said property. If you only want to report on last item created, you can do so via Get-MailboxFolderStatistics.
Get-EXOMailboxStatistics will emit LastUserActionTime & LastInteractionTime in the upcoming GA version of EXO V2 module which were earlier available only with Get-MailboxStatistics
This new version will be available in Feb 2021.
what replaced it? Is it possible to get these properties from the graph api?
Can you please confirm if LastUserActionTime is the most reliable way for use to get actual user activity? Also that LastInteractionTime is plagued by non-user access, such as Managed Folder Assistant as an example?
Thanks in advance.
How do you access those properties in the modern times with oauth2 and modern authentication and the newly released Exchange V2 cmdlets, in a world where basic auth is being banned? Get-EXOMailboxstatistics does not allow access to ‘LastUserActionTime’ nor to ‘LastUserActionUpdatetime’ or ‘LastUserActionWorkloadAggregateTime’. The good old Get-Mailboxstatistics gave at least access to ‘LastUserActionTime’, which is so much more reliable and often more correct than the ‘LbannedastLogonTime’.
MS has since removed most of these, they are only available as part of the mailbox diagnostic logs nowadays. But you should have no problem using the “old” cmdlets via modern auth, they just released support for certificate-based auth.
I have a large cache of accounts that an Office365 Power BI report says are “Inactive in all of Office365”..
When I run the Get-MailboxStatistics commandlet against those accounts, the LastInteractionTime and the LastUserActionTime indeed does say that it has been months since there was interaction.
However, the LastLogonTime and LastLogoffTime are both within the last 24 hours.
I’m wondering how these are calculated and what possible circumstance would say that there has been no interaction even though the mailbox is being logged into and out of constantly….
You shouldn’t be using those properties, they get updated by background processes accessing the mailbox and such. Tony wrote about it a while back: https://www.petri.com/get-mailboxstatistics-cmdlet-wrong
Odd that they don’t have any documentation for it. I checked my mailbox and it seems like it was accurate up to the day before, but I’m not sure if that’s consistent.