Forum Discussion
Exchange Online Mail Traffic Report
Are you including both outbound and inbound messages in the trace? The reports do that (directionality is set to "All" by default), and if you run the same report from the SCC (https://protection.office.com/#/reportv2?id=SentAndReceivedMailATP&pivot=EventType), you will actually get a breakdown by sent/received messages. Similarly, make sure you include all recipients.
Also make sure to account for the timezones when doing the trace for a specific date range. The only differences I can spot in my tenant are for the first/last day, probably due to the cutoff time.
Good Evening Vasil: Yes I have it set to run both Inbound & Outbound msg, in addition to I actually included 2 extra days just to make sure that I could pull everything. My main concern was that something had "slipped" through Exchange when it was not suppose to. Yes I'm using Security & Compliance portal to run the trace. Really like that we are not restricted to just 7 day logs, It's nice to be able to pull additional days with out having to wait for Exchange team to run the logs for us.
Well the data from those two sources seems to match in my case, but after all that's my personal tenant with just ~100 messages per day. I guess you can open a support case to get this investigated?
