Direct Send Audit Companion

This repository contains a PowerShell script, Get-DirectSendReport.ps1, which retrieves Direct Send (SMTP) activity from Exchange Online's Unified Audit Log, up to 30 days of history.

Blog post: https://www.cloudythoughts.cloud/2025/08/04/exchange-online-direct-send-report/

Features

• Splits your specified range into N-hour windows (default 6h).
• Live progress bar with ETA and per-window counts.
• Automatically retries failed windows by splitting them in half.
• Filters for Protocol: SMTP and ClientIP, safely parses JSON.
• Exports both CSV and a sortable HTML report.

Usage

# Last 7 days in 6h windows
.\Get-DirectSendReport.ps1 -DaysBack 7

# Custom range, 12h windows
.\Get-DirectSendReport.ps1 -StartDate (Get-Date).AddDays(-3) `
                          -EndDate   (Get-Date) `
                          -WindowHours 12

License

MIT