View email security reports in the Security & Compliance Center

If you are anOffice 365 global administrator, security administrator, or security reader, you can view your organization's email security reports in the Security & Compliance Center. To view the reports, go to Reports > Dashboard.

The Security & Compliance Center dashboard can help you see where Advanced Threat Protection is working

Email security reports include the following:

Tip: If your organization is using Office 365 Advanced Threat Protection, additional reports are available, including new real-time reports. See View reports for Office 365 Advanced Threat Protection.

User-reported messages report

To view this report, in the Security & Compliance Center, go to Threat management > Review > User-reported messages.

In the Security & Compliance Center, choose Threat management > Review > User reported messages

With this new real-time report, global administrators, security administrators, and security analysts can review user-reported email messages. This report lists the email messages that users have determined to be junk, phishing attempts, or good mail wrongly classified as junk.

The User-Reported Messages report shows messages users labeled as junk, not junk, or phishing attempts.

Important: In order for the user-reported messages report to work correctly, audit logging must be turned on for your Office 365 environment. This is typically done by someone who has the Audit Logs role assigned in Exchange Online. For more information, see Turn Office 365 audit log search on or off.

Details are available for each message, including the delivery reason, such a spam policy exception or mail flow rule configured for your organization. To view details, select an item in the user-reports list, and then view the information on the Summary and Details tabs.

Top malware report

The report shows the various kinds of malware that was detected by Exchange Online.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Top Malware.

SCC - EOP Top Malware

When you hover over a wedge in the pie chart, you can see the name of a kind of malware and how many messages were detected as having that malware.

Click (or tap) the report to open it in a new browser window, where you can get a more detailed view of the report.

This report shows the top malware detected for your organization

Below the chart, you'll see a list of detected malware and how many messages were detected as having that malware.

Top senders and recipients report

The report is a pie chart showing your top email senders.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Top Senders and Recipients.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Top Senders and Recipients

When you hover over a wedge in the pie chart, you can see a count of messages sent or received.

Click (or tap) the report to open it in a new browser window, where you can get a more detailed view of the report.

Use the Show data for list to choose whether to view data for top senders, receivers, spam recipients, and malware recipients. You can also see who received malware that was detected by Advanced Threat Protection.

Use the Show Data For list to view specific information

Below the chart, you'll see who the top email senders or recipients were, along with a count of messages sent or received for the given time period.

Spoof mail report

The report shows how many spoof mail messages were detected, and of those, which ones were considered "good" (spoof mail done for legitimate business reasons).

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Spoof Mail.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Spoof Mail

When you hover over a day in the chart, you can see how many spoof mail messages came through.

Click (or tap) the report to open it in a new browser window, where you can get a more detailed view of the report.

Spam detections report

The report shows all the spam content blocked by Exchange Online.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Spam Detections.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > EOP Spam Detections

When you hover over a day in the chart, you can see how many items were blocked that day, as well as how those items are categorized. For example, you can see how many spam messages were filtered, and how many items came from a blocked Internet Protocol (IP) address.

Click (or tap) the report to open it in a new browser window, where you can get a more detailed view of the report.

The Spam Detections report tells you how many spam messages were blocked or filtered out

Below the chart, you'll see a list of spam items that were detected. Select an item to view additional information, such as whether the spam item was inbound or outbound, its message ID, and its recipient.

Sent and received email report

The report shows information about incoming and outgoing email, including spam detections, malware, and "good" email.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Sent and received email.

To view this report, in the Security & Compliance Center, go to Reports > Dashboard > Sent and received email

When you hover over a day in the chart, you can see how many messages came in, and how those messages are categorized. For example, you can see how many messages were detected as containing malware, and how many were identified as spam.

Click (or tap) the report to open it in a new browser window, where you can get a more detailed view of the report.

You can use the Break down by list to view information by type or by direction (incoming and outgoing).

Use the Break Down By list to view information by type or direction

Below the chart, you'll see a list of email categories, such as GoodMail, SpamContentFiltered, and so on. Select a category to view additional information, such as actions that were taken for malware, and whether email was incoming or outgoing.

This report tells you about anti-malware, anti-spam, and other message detections

What if the reports aren't showing data?

If you are not seeing data in your reports, double-check that your policies are set up correctly. To learn more, see Anti-spam and anti-malware protection in Office 365.

Related topics

Office 365 Advanced Threat Protection
View reports for Office 365 Advanced Threat Protection

Expand your skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×