Get Outlook versions

[Alan McFarlane]

How do I get a report/etc of Outlook versions connecting to EO? I presume on-prem I would use Get-LogonStatistics which isn't available on EO. I can't see a suitable report in new or old admin portal.

I ask as we got this Message in one of our client tenants. Maybe a Mac Office version issue?

[[

    Updated Feature: Web support for Outlook 2007 and 2010

    /!\ Action required by Oct 25, 2016

    [...] You are receiving this message because our reporting indicates you have at least one user in your organization connecting to Office 365, using either Outlook 2007 or Outlook 2010. [...]

]]

[#2]

Not 100% sure this will work against EXO, but used this in an on prem version last week and it worked great: 

http://mikefrobbins.com/2014/09/18/use-powershell-to-determine-what-outlook-client-versions-are-acce...

[#3]

You can check the Activity logs in the SCC (https://protection.office.com/#/unifiedauditlog). For example, filter by "Created or received message" then export the logs to CSV, the client information will be visible there.

[#4]

@Paul Bridges no, this will not work against EO, as we dont have access to the logs.

[#5]

Ahh - didn't even think about that. Sorry, early morning brain fart, ha. 

[#6]

Thanks Vasil. I'll look at that again then. I didn't have it enabled on the respective tenant but it is now!

On another tenant I looked and there were no useful entries. I wonder why??

Ahh needs turned on for all individual mailboxes?  Yeh?  https://support.office.com/en-gb/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-...

[#7]

Yup, you need auditing enabled on each mailbox for the events to be gathered. Otherwise you can rely on the Logon events, but in my experience they're not that reliable client version-wise.

Another option is to try Get-ConnectionByClientTypeReport, though it only lists the protocol (OWA/EWS/EAS/etc).

If you are running AD FS, you can also get the client info from the event logs.

[#8]

Thanks Vasil. I turned on the auditing last night and will see what today's logging brings.

Yup, had tried that. But not even client name (never mind version) AFAICS.