21 May 2019 by Steve Goodman
How to Migrate Exchange to Office 365: Step by Step – Part 2
How to set up Exchange Hybrid and migrate mailboxes.
This blog series takes a deep dive into Office 365 reporting using Radar Reporting, providing a framework for beginning to configure your necessary reports. As we’ll see, there are plenty of different reasons why you might need to get regular insights into what’s happening in your environment. You might have a number of different stakeholders, beyond the IT team, that require operational updates (Project Managers, Security Officers, CTOs to name a few). Each of these individuals will have equally diverse reporting scenarios – some need daily updates, others monthly reviews, they may require high-level, top-down information or extremely granular detail, depending on their role, their interest might be operational or financial.
Sometimes it’s unclear what to set up, where, and for whom. This series should provide a solid starting point for any organization, outlining what you need to be reporting on, and when (split down into daily, weekly, and monthly timescales).
If you are new to managing O365, keeping the tenant healthy and running is the name of the game. But, how do you know your tenant is healthy or that there isn’t a tidal wave of support tickets coming your way?
Daily Dashboards can help you spot problems before they become critical and make it easy to review and understand your tenant health each day. Much like reading the headlines on the morning commute, dashboards give you a high-level overview of what’s been happening inside your tenant.
Service status will tell you what is impacting the tenant from Microsoft, these can be small incidents, faults or service disruption. Something to be aware of here is that outages like these can cause tickets to back up in the service desk. Once a fault is spotted, it’s good practice to let the users know that there is a major impact on the service.
Next, look at mail traffic. A healthy tenant will show signs of consistent traffic. What you should be looking for here is any sharp or marked changes in the data. Our example shows that something is up as the tenant is receiving mail but rarely sending. This information highlights the issue and indicates where you should investigate – before those tickets start rolling in.
Now for spam and malware traffic. Again, at a glance, you would expect to see this skewed in favor of inbound rather than outbound. A skew in outbound traffic could be a false positive if there is an email campaign running, or alternatively, there may be a compromised account sending out spam. A healthy tenant would look something like this (see image below). You can see that there is some outbound spam, which is to be expected as the filters intercept most emails, but there’s typically nothing to investigate unless there are other security factors at play.
With messaging working as intended, we can move onto Skype for Business and storage. If you know that there is a global issue then something resembling our screenshot here wouldn’t be surprising, however if you have been using the service for some time then zero usage is a serious concern, indicating a system issue, and that people are not able to communicate, call, or meet using the platform. Again, the Dashboard will show you at a glance any potential Skype for Business issues within the tenant.
When we’re looking for healthy storage, we are looking for usage indicators. Users should be storing files on the company drives or in the appropriate places, rather than on personal devices that can be lost or stolen. In the case of OneDrive for Business, each user has a cap of 20,000 items on top of their size cap. Should a user hit this in a day or equally short time period, then we should investigate before the user syncs or uploads any more files. This could be a cause for concern, or a situation where the user has unresolved issues with their files.
When we look at SharePoint Online, the key areas to look at are libraries and folders – our last two tiles in the dashboard. Should these areas jump unexpectedly it can mean a user or program is trying to upload a very large file or too many files, in the case of a drive or .zip file split into archives.
As we’ve seen in our quick ‘widget-by-widget’ tour, these areas and components are the building blocks of an effective dashboard. Of course, you may find that there are other areas, specific to your environment/ projects/ initiatives that you may wish to track. In Radar Reporting, it is simple to build your dashboard, just click the pencil icon (highlighted in grey here) and add or remove the different widgets as required.
Now that we’ve covered the analytics that should be monitored daily, our next post will take a look at the key reporting areas that should be reviewed on a weekly basis.
Existing Radar Reporting user? Why not take a look at your Dashboards and check you’re tracking everything you should be? Log into the application here.
Not yet using Radar Reporting? If you want to see how advanced Office 365 activity reporting and analytics can help you better understand and protect your environment, why not sign up for a free 14-day trial?