Compliance Problems

How to Report Email Activity for Secondary Domains in Microsoft 365

Maira Mehtab Sep 20, 2026 868 views

Question details

A Microsoft 365 administrator needs to generate a report detailing emails sent or received via alternate addresses on secondary domains within the same tenant.

Product: Microsoft 365
Device & OS: not provided
Scenario: Tracking email traffic and compliance metrics across alternate domains within a single Microsoft 365 environment.
Observed behavior: Microsoft 365 lacks a direct, built-in report that specifically isolates and filters email activity by secondary domains.

Before you start

Ensure you have the necessary global administrator or Exchange administrator privileges in your Microsoft 365 tenant, and verify that the Microsoft Graph PowerShell module is installed on your workstation.

Solution 1Recommended

Extract Detailed Mail Activity via Microsoft Graph PowerShell

The most robust and flexible method for filtering mail traffic by secondary domains or proxy addresses is using custom PowerShell scripts.

Since the standard reporting tools group aliases under the primary mailbox UPN, PowerShell allows administrators to query raw message trace logs and filter the sender or recipient fields by the specific secondary domain string.

Connect to Exchange Online and Graph PowerShell

Open PowerShell as an administrator and run the necessary connection cmdlets (e.g., Connect-ExchangeOnline) using your administrator credentials.

Run a Message Trace

Use the Get-MessageTrace cmdlet to retrieve email data over the desired time frame.

Filter by Secondary Domain

Pipe the results into a Where-Object filter that matches the sender or recipient address against your secondary domain (e.g., *@secondarydomain.com).

Export the Results

Export the filtered dataset to a CSV file using Export-Csv so it can be analyzed in spreadsheet software.

Solution 2

Use Mailbox Audit Logs to Track Relevant Activity

Leverage the built-in Microsoft Purview audit logging feature to monitor relevant mailbox actions and access logs.

Solution 3

Request Assistance for Custom Reporting Solutions

If standard logs and basic PowerShell scripts do not meet your exact compliance reporting needs, consult with Microsoft Support or the PowerShell community.

Free Microsoft Office alternative

Analyze Your Exported Microsoft 365 Reports with WPS Office

Once you have exported your email activity logs as CSV files using PowerShell or Audit Logs, you need a reliable spreadsheet tool to filter and analyze the data. WPS Office provides a lightweight, fully compatible, and free alternative to Microsoft Excel, making log analysis seamless.

1. Download and Install WPS Office: Visit the official WPS Office website to download and install the free suite on your computer.
2. Open Your Exported CSV Log: Launch WPS Spreadsheet and open the CSV file you exported from Microsoft Graph PowerShell or the Purview portal.
3. Analyze the Secondary Domain Data: Use Data filters and Pivot Tables in WPS Spreadsheet to sort and visualize your email activity effectively.

Fully compatible with Microsoft Excel (.xlsx) and CSV formats for instant log analysis.Free, lightweight, and fast installation on Windows, Mac, and Linux.Familiar user interface, meaning zero learning curve for Microsoft Office users.Advanced filtering and pivot table features to easily sort secondary domain data.

microsoft office alternative - wps office

Frequently Asked Questions

Why doesn't Microsoft 365 show secondary domains in standard email reports?

Built-in Microsoft 365 usage reports typically aggregate data at the primary mailbox level. This means any email traffic flowing through alias addresses or secondary domains is grouped under the user's primary User Principal Name (UPN).

Can I filter a standard Message Trace by a specific domain alias?

Yes, you can specify a precise sender or recipient address—including alias addresses on secondary domains—when running an extended Message Trace in the Exchange Admin Center, though exporting bulk reports across the whole domain requires PowerShell.

Are mailbox audit logs enabled by default in Microsoft 365?

Yes, Microsoft currently enables mailbox audit logging by default for all organizations, allowing administrators to immediately search for specific mailbox access and modification actions without prior setup.

Microsoft Office Security Issues