Back to blog

Monthly Office 365 Reporting: Confessions of a ‘Reports Geek’

Aug 13, 2018 by Russ McKeith

Missed the start of this series? Read Part 1 (Daily Reporting), and Part 2 (Weekly Reporting) to catch up!

Monthly Reporting in Office 365

As we’ve seen so far in this series, reporting can be used for a range of different use cases by a wide number of teams or individuals. Keeping in line with the medical analogy we’ve used thus far –  if daily reporting is checking your vital statistics, weekly reporting measures ‘quality of life’, monthly reporting is like the head-to-toe physical you have every now and then, that highlights potential issues, prompts advice for maintaining good health, and could increase your health insurance premium. Luckily this is the last in blog series, as I think we’ve stretched this analogy as far as it can go! Ultimately, monthly reporting delivers business insights that are high-level and can be applied to the entirety of the organization. They are typically financial in nature, demonstrating ROI on the IT investment, contingency planning for the future, and unearthing any notable trends or actions on a macro scale.

Monthly reporting - Dashboards

If you have a responsibility to report back to upper management on key business-wide insights, it is important to think clearly about not only what data you must present, but also the format, context, and grouping of your insights. You may find that are many specific data expectations once you move into a Microsoft 365 environment, ‘show me our return on investment’, ‘is there a visible increase in productivity or collaboration?’, ‘are we saving money?!?!’. Overall, monthly reporting should be geared to ROI, productivity, and any resource planning from the business. This should be undertaken monthly, and the data used must underpin any insights or issues experienced by business units as whole, rather than specific users or issues. This could be the need for training or additional equipment. A great example of additional equipment is headsets, as they’re a great way to drive VoIP adoptions in Skype or Teams, improving collaboration.

Bringing this back to data presentation, one way to deliver this information is by using a dashboard. This is a great way to collect these data points efficiently, and present them to management or even use to highlight any trends within the business. When looking at all the reports available for a tenant, it can be confusing and overwhelming to sift through for what data or report is ‘important’ to business owners. The dashboard is a good way to present key elements of the tenant as a whole, and talk through the highlights of a full data set.

Subscription cost analysis

Demonstrating where the business can save money is crucial to profitability. If some licenses can be re-assigned (leavers/ unused accounts) or downgraded then these cost savings will mount up over the months and so it’s clear why effective Office 365 license management should be a key component for all organizations. This can be broken down into specific products, license types to show a holistic view of the tenant for management purposes.


Looking at the raw data for measuring usage across the tenant will show where there is a need for provisioning or if there are some products that can be re-assigned within a department. This is especially useful to show where there may need to be a buffer or contingency, should a number of free licenses need to be held, we see this in industries such as retail or where seasonal workers are onboarded (and off-boarded) en-masse.

Subscription Product Analytics

Office 365 licensing trends

When looking at longer term adoption trends from a high level we should look to see growth over time until reaching the full maturity of the tenant with active and consumed licenses reaching around the same levels. By ‘consumed’ we mean that the license has been assigned to the user (active) and that that user has logged in and performed an action. In our example, we can see that there is some adoption work to do to bring our lines into close parity and achieving worthwhile use.

Licence Usage over time

Spotting security trends and attacks

When we look at a longer data timeline we can start to see accounts or users that could become a treat vector, and how they could become a problem for the business. On average a user interacts with a tenant 97 times each day and threat actors know this. Should an account become a target we may see anomalies in these trends that can help us understand the type of attack and the possible threat actors we can also perform back tracing on the IP to gather further information. However, when presenting this to management it can be a good lever to enforce stronger policies around passwords or email address usage. For example, users may be using their work email as a login name for some personal applications (Facebook, Twitter, LinkedIn) and this opens the account to the possibility of being in a third-party breach.

Failed Events Report


Office 365 reporting

The power of reporting is not necessarily in the data itself, but in how the recipient will view and interpret the trends and insights put before them. As part of our Office 365 reporting team, I often see recipients consuming the same data set in completely different ways, while still getting the value that they need. A simple usage report can mean very different things to someone in Procurement, Management, or to those on the service desk.

I hope you’ve found this series helpful, and that it has highlighted the benefits that come from regular, detailed, use-case specific reporting. I would like to reiterate the fact that what we’ve covered is merely a starting point. Each business is unique, and so are their needs. Our reporting solution is a powerful tool, but perhaps more importantly, it is a flexible, customisable reporting tool. There are countless ways to find and utilise your data, translating it into meaningful actions across your entire organisation.

You find out more about our Office 365 reporting tool here.

Underneath, we’ve listed the reports we’ve used across this series for reference.

Office 365 reports used in this blog series

Administrator Activities SharePoint Permissions
Audit Timeline Teams usage
Failed Events License by product
Inventory Report Subscription Product Analysis
Tenant Dashboard Subscription Cost Analyser
License by user Inactive Mobile Devices
License by service Recursive Permissions
Mail Traffic SharePoint External Users
Spam and Malware Traffic Inactive Mailboxes
Service Status DLP Events
License Usage over Time User Mailbox Security