Exchange Online Mail Traffic Report

[Scott Johnson]

I've noticed a couple of times when I look at my weekly MailTraffic report that the number of "Spam" messages do not equal the amount when I run a mail trace for the same time period.  I've also take into consideration IP blocks as well.  Just wondering what could be the cause.  Appreciate the assistance.

[#2]

Are you including both outbound and inbound messages in the trace? The reports do that (directionality is set to "All" by default), and if you run the same report from the SCC (https://protection.office.com/#/reportv2?id=SentAndReceivedMailATP&pivot=EventType), you will actually get a breakdown by sent/received messages. Similarly, make sure you include all recipients.

Also make sure to account for the timezones when doing the trace for a specific date range. The only differences I can spot in my tenant are for the first/last day, probably due to the cutoff time.

[#3]

Good Evening Vasil: Yes I have it set to run both Inbound & Outbound msg, in addition to I actually included 2 extra days just to make sure that I could pull everything.  My main concern was that something had "slipped" through Exchange when it was not suppose to.  Yes I'm using Security & Compliance portal to run the trace.  Really like that we are not restricted to just 7 day logs,  It's nice to be able to pull additional days with out having to wait for Exchange team to run the logs for us.

[#4]

Well the data from those two sources seems to match in my case, but after all that's my personal tenant with just ~100 messages per day. I guess you can open a support case to get this investigated?