Message Trace & Headers for Office 365 Enhancements (Feb 2014)

Scott LandryMicrosoft CorporationSupport Webcast Series

Management SurfacesIntroduction

3

• We are recording today’s session, and will have the slide show presentation and the video recording on the original blog post and the Office 365 Community. You can find the video recording on our Video Channel - http://www.youtube.com/microsoftoffice365

• Questions can be asked at the end of the presentation through the Lync Meeting Console.

• We are recording today’s session, please understand that you may be captured in the recording. If you do not wish to be recorded, please do not type in the Lync IM Window or please leave the meeting.

Welcome to the webcast

Management SurfacesMessage Header Analyzer

5

• Remote Connectivity Analyzer (http://testconnectivity.microsoft.com)

Message Header Analyzer

6

• Can be added to OWA & Outlook as an app

Message Header AnalyzerNe

w!

7

Message Header Analyzer

Management SurfacesEnhancements to Message Trace

9

• Search up to 90 days

• Get routing details

EnhancementsNe

w!

New!

10

How it works

New!

“Basic” Message Trace “Extended” Message Trace(Historical Search)

Data Set Between approx. 15 minutes & 7 days

Between approx. 8 hours & 90 days

View Results In UI Download

Results In seconds In minutes/hours (can configure notification email address)

Routing Details Basic detail only Full detail optional

Maximum Size 500 5,000 (3,000 for detail)

Max Queries / Day Reasonable limits 15 per tenant

New!

11

• Go to Exchange Admin Center

• Click mail flow

• Click message trace

Finding Message Trace

12

• Uses the existing UI which has been slightly modified

Using the new functionality

13

• Select “custom” date range

• Select start and end date/times – narrower time frames may help

• Must specify sender, recipient, or msg id - wildcards ok, but *d@contoso.com not supported

Using the new functionality

14

• After selecting a period outside of 7 days, new options appear

• “Include message events and routing details with report”

• Notification email address

Using the new functionality

15

• Click to see running & completed reports

• Reports available for 10 days

• Results of 5000 (or 3000 for detailed) should not be trusted to be complete (truncated warning message)

• Scroll to bottom to download the results

Downloading completed traces

16

• Recommend using Excel

• DATA -> Filter

• Sort by date_time

• More information about the fields & value meanings: http://technet.microsoft.com/en-us/library/bb124375(v=exchg.150).aspx

Reviewing traces

17

• Basic: Get-MessageTrace, Get-MessageTraceDetail

• Extended: Start-HistoricalSearch, Stop-HistoricalSearch, Get-HistoricalSearch

• Pull results inside of (and shorter than) 7 days (but still >8 hours)

• Search on advanced criteria, like find all messages that hit a particular DLP rule

PowerShell

New!

Start-HistoricalSearch [[-Organization] <OrganizationIdParameter>] -ReportType <HistoricalSearchReportType> {MessageTrace | MessageTraceDetail | DLP | TransportRule | SPAM | Malware} -ReportTitle <string> -StartDate <datetime> -EndDate <datetime> [-NotifyAddress <MultiValuedProperty[string]>] [-DeliveryStatus <string>] [-SenderAddress <MultiValuedProperty[string]>] [-RecipientAddress <MultiValuedProperty[string]>] [-OriginalClientIP <string>] [-MessageID <MultiValuedProperty[string]>] [-DLPPolicy <MultiValuedProperty[guid]>] [-TransportRule <MultiValuedProperty[guid]>] [-Locale <cultureinfo>] [-Direction <MessageDirection> {All | Sent | Received}]

Management SurfacesWhat about Delivery Reports?

19

• Admins should NOT rely on this feature – use Message Trace instead

• Could eventually be removed from Exchange Admin Center for Office 365

• End users will still be able to get Delivery Reports for themselves, however:

• Delivery Reports can only be searched for within a few days of message being

sent (after which an error may occur)

• No immediately planned improvements

Delivery Reports

Management SurfacesScenarios for Message Trace

21

• Check to see if there is any record of the message (if no record, then you’ll need to check with the sender)

• Check hygiene results

• Look for hints about where it may have gone (forwards, rules, etc.)

Scenario: Inbound

22

• Make sure the message was received from Outlook client (if not, troubleshoot Outlook)

• Look for SMTP SEND Event

Scenario: Outbound

Management SurfacesFuture

24

• Remain committed to additional investments to Message Trace

• Top priority: Usability & performance• Goal: bring more detail to “Basic” Message Trace• Search by Subject – still on our radar, no current ETA

• Soon - View message headers in quarantine

Future

25

• Please answer the survey questions posted at the end of this meeting.

• Let us know what sessions you want! Email Heather Correa at v-hcorre@Microsoft.com.

• Feel free to give feedback too.

Feedback

Management SurfacesQ&A and Feedback

27

• Feedback received about maximum of 15 queries per day. We will continue to monitor performance and allow additional queries if possible. Support does not currently have access to run queries on behalf of customers except in extreme cases. Consider using e-discovery features for legal discovery matters.

• Feedback received about up-to 8 hours to process. This only applies to the new Historical Search feature.

• Two questions came up about emails blocked by DNS BLs / IP reputation. These emails will be rejected at the perimeter, and the sending server must generate an NDR. All of this happens

without Office 365 accepting the message or even getting a msg id. Therefore these messages do NOT show up in Message Trace. Messages which are content filtered, do show up im Message Trace. In addition, you can report on both types of rejections using the “Received Spam” Report (note “IP blocked”):

Q&A

© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.