Office 365 provides users with 50 GB mailbox quotas, so you’d expect that these mailboxes accumulate tens of thousands of items over time, especially as the default retention policy applied by Exchange Online does not clean out Deleted Items folders from user mailboxes (unless you change the policy).

Users are happy because they can keep as much data as they like while organizations are happy because data is retained for compliance purposes. So when reports suddenly show a major drop in the amount of data stored in Office 365 mailboxes, it’s a matter of some concern.

Which is exactly what happened in my Office 365 tenant in mid-May when the number of items reported for a number of mailboxes – but not all – suddenly had an alarming decline. Take the example of my own mailbox (below) where the item count reduced from nearly 272,000 to under 70,000.

The same decline was seen for a number of other mailboxes in the tenant:

Looking at this from a tenant perspective (using the reporting facilities from Cogmotive.com), the drop-off is very obvious. In fact, it’s like the item count fell off a cliff face.

The number of mailbox items in an Office 365 tenant

Behind the scenes, reporting products like Cogmotive depend on public interfaces provided by Microsoft to extract data that they use to generate reports like “Mailbox Item Count over Time”. Cogmotive connects to Office 365 regularly to fetch data on behalf of the tenants that have signed up for their service and stores this data for future reference, which is how they can provide charts of information over time.

In this case, Cogmotive uses the Get-MailboxStatistics cmdlet to fetch data about mailbox usage and this is where the problem seems to lie. If I run Get-MailboxStatistics against my mailbox, it reports:

DisplayName               ItemCount    LastLogonTime

Tony Redmond              71267        17-May-16 6:47:57 AM

However, if I run the Get-MailboxFolderStatistics cmdlet to report the items stored in each folder and export the data to Excel, I get a different figure:

Get-MailboxFolderStatistics –Identity TRedmond | Select Identity, ItemsInFolder | Export-CSV c:\temp\Items.csv –NoTypeInformation

The true count of items in a mailbox

There’s quite a difference in the figures reported by the two cmdlets: 71,267 and 222,276!

[Note to self: Maybe I should stop auditing owner events in my mailbox. Maybe Get-MailboxStatistics doesn’t like counting those audit items]

In any case, it seems like a change in behavior with the Get-MailboxStatistics cmdlet happened sometime in the middle of May. It’s strange that this should happen with Get-MailboxStatistics as the cmdlet was one of the original set introduced with Exchange 2007 and hasn’t change in scope or functionality much since. I know that the issue is not evident in just my Office 365 tenant as several Cogmotive customers have reported the same problem.

The issue has been reported to Microsoft. No doubt we’ll find out what happened in due course. In the interim, if you have some reports that depend on Get-MailboxStatistics, perhaps you need to check the output to ensure that it’s accurate.

Follow Tony @12Knocksinna