Office 365: Tracking last run times of the managed folder assistance / exchange life cycle.

In Office 365 the managed folder assistance is responsible for applying data retention policies to mailbox items.  For example, if you have a policy to purge items older that 90 days from deleted items – the managed folder assistant will process this information.

A question that sometimes arises is how can I track the last time the managed folder assistant processed a given mailbox.  Administrators of Exchange Online actually have an interface into this information.  Within the Exchange Online Management Shell there is a commandlet Export-MailboxDiagnosticLogs.  This commandlet will extract the details of the mailbox folder assistant process.  Here is an example:

PS C:\> Export-MailboxDiagnosticLogs -Identity tmcmichael -ExtendedProperties > c:\temp\output.txt

RunspaceId : 1290130b-c3af-49c2-a42c-b9dd98ed702d

MailboxLog : <Properties>
<MailboxTable>
<Property>
<Name>DatabaseSchemaVersion</Name>
<Value>65543</Value>
</Property>
<Property>
<Name>StorageQuotaLimit</Name>
<Value>51380224</Value>
</Property>
<Property>
<Name>NormalMessageSize64</Name>
<Value>437365777</Value>
</Property>
<Property>
<Name>SystemMessageSize</Name>
<Value>93908012</Value>
</Property>
<Property>
<Name>TotalPages</Name>
<Value>41405</Value>
</Property>
<Property>
<Name>PersistableTenantPartitionHint</Name>
<Value>0xA8ECFDEE5058A54CA1600716F2D8496E</Value>
</Property>
<Property>
<Name>IsContentIndexingEnabled</Name>
<Value>True</Value>
</Property>
<Property>
<Name>ProhibitReceiveQuota</Name>
<Value>52428800</Value>
</Property>

………………………..

                  <Property>
<Name>DisplayName</Name>
<Value>Timothy McMichael</Value>
</Property>
<Property>
<Name>StoreEntryId</Name>
<Value>0x000000001B55FA20AA6611CD9BC800AA002FC45A09004800534E36505230364D42343132352E6E616D70726430
362E70726F642E6F75746C6F6F6B2E636F6D0012252C7D0E254B40AA6BABAF0A40F1FE7110C9033B684947B56544938EFF582F</V
alue>
</Property>
</MailboxTable>
</Properties>

LogName : ExtendedProperties

Identity : Timothy McMichael

IsValid : True

ObjectState : Unchanged

The output above is abbreviated as it is quite large.  One of the fields contained within the XML output is the ELCLastSuccessTimestamp.  Here is an example.

<Property>
<Name>ELCLastSuccessTimestamp</Name>
<Value>2/13/2019 12:20:18 PM</Value>

</Property>

In this example the last time the mailbox folder assistant processed the given mailbox was on 2/13 at 12:20.  The commandlet itself is excellent for extracting single mailbox data.  What happens if we want to generate a report for multiple mailboxes?

If the need arises to query multiple mailboxes the following code can be utilized.

$mailboxes = get-mailbox -resultsize unlimited

$mailboxes |

% { $exportPath = "c:\temp\"+$_.alias+".xml" ;

    $exportPath ;

$xml = Export-MailboxDiagnosticLogs -ExtendedProperties -Identity $_.alias ;

$xml | Export-Clixml -Path $exportPath ;

$mailboxIdentity = ([Xml]$xml.MailboxLog).Properties.MailboxTable.Property | where { $_.Name -eq 'DisplayName' } ;

$mailboxIdentity.value ; $elcLastSuccessTimestamp = ([Xml]$xml.MailboxLog).Properties.MailboxTable.Property | where { $_.Name -eq 'ELCLastSuccessTimestamp' } ;

$elcLastSuccessTimestamp.value ; $object = new-object -TypeName PSObject ;

$object | Add-Member -MemberType NoteProperty -Name DisplayName -Value $mailboxIdentity.value ;

$object | add-member -memberType NoteProperty -name "Alias" -value $_.alias ;

$object | add-member -memberType NoteProperty -name "PrimarySMTPAddress" -value $_.primarySMTPAddress ;

$object | Add-Member -MemberType NoteProperty -Name ELCLastSuccessTimestamp -Value $elcLastSuccessTimestamp.value ;

$object | Export-Csv -Path c:\temp\output.csv -Append ; start-sleep -Milliseconds 500
}

In the first command we gather all of the mailboxes in the organization.  If your organization is large it is recommended to batch this to smaller numbers of mailboxes by performing a filter on the get-mailbox.  We then take the list of mailboxes and move it into a loop – where we process each mailbox by pulling the diagnostic logging.  With the diagnostic log pulled we extract pertinent information such as display name and last run time.  This is intentionally pulled from the XML to validate we are aligning the output to the correct export data.  An object is then built containing the information from the XML output and from the mailbox output stored in the array.  These objects are then exported to a CSV file.  The CSV file can be manipulated in excel.

Here is a sample CSV file:

#TYPE System.Management.Automation.PSCustomObject

"DisplayName","Alias","PrimarySMTPAddress","ELCLastSuccessTimestamp"

"Alert Mailbox","alert","alert@domain.org","2/12/2019 10:11:34 PM"

"AH","a-alias","a-alias@domain.org","2/12/2019 11:55:21 PM"

"BM","b-alias","b-alias@domain.org","2/13/2019 9:07:35 AM"

In the output directory specified the XML is retained in case further analysis is necessary.

This method utilizing powershell allows us to interrogate multiple mailboxes and determine the last time the managed folder assistant processed the mailbox.