Data Protection Issues

How to Retrieve Historical Email Security Data in Microsoft 365 Defender

Partner Editor Oct 10, 2026 870 views

Question details

Administrators need to retrieve historical email security data for spam, phishing, and malware beyond the typical timeframe limits.

How to Retrieve Historical Email Security Data in Microsoft 365 Defender

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Attempting to programmatically or historically access email delivery and security categories over extended periods.
Observed behavior: Get-MessageTrace limits historical searches, making it difficult to extract long-term message counts and programmatic data from the previous 90 days or six months.

Before you start

Ensure you have the necessary administrator permissions, such as Security Administrator or Global Administrator, in Microsoft 365 to access Defender reports.

Solution 1Recommended

Use Email and Collaboration Reports in Microsoft 365 Defender

Since Get-MessageTrace has historical limits, use the built-in Defender reports to view long-term trends for spam, malware, and phishing.

While programmatic access like PowerShell's Get-MessageTrace has time restrictions, the Microsoft 365 Defender portal offers comprehensive visual reports. These reports help administrators track historical email security data over extended periods.

Note that while this provides excellent visual trending data, fully programmatic API access for long-term data may currently be limited. You should monitor the Microsoft 365 roadmap for future Defender reporting and API improvements.

Access the Defender Portal

Navigate to Reports

Locate and click on the 'Reports' section in the left-hand navigation pane.

Open Email & Collaboration

Select 'Email & collaboration' to access your organization's security reports.

Review Historical Data

Open the Threat Protection status report to analyze historical trends for spam, malware, and phishing over your desired date range.

Use Email and Collaboration Reports in Microsoft 365 Defender

Programmatic Access Limitation: Currently, programmatic access to extended historical data is limited. Check the Microsoft 365 Roadmap for planned Microsoft Defender for Office 365 features regarding API improvements.

Free Microsoft Office alternative

Need a Lightweight Office Suite for Your Organization?

While you manage your organization's email security in Microsoft 365, consider WPS Office as a free, lightweight, and highly compatible alternative for your team's document processing needs. It offers a familiar interface and seamless migration for Word, Excel, and PowerPoint files.

1. Download WPS Office: Visit the official WPS website and download the free installation package.
2. Install the Software: Run the installer and follow the on-screen instructions to deploy WPS Office on your devices.
3. Open Your Documents: Seamlessly open, edit, and save your existing Microsoft Office files without formatting loss.

Highly compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Lightweight and requires fewer system resourcesFamiliar user interface for quick team onboardingAdvanced data protection and document encryption features

Frequently Asked Questions

What is the historical search limit for Get-MessageTrace?

In Exchange Online, the standard Get-MessageTrace cmdlet can quickly search data for the past 10 days. For messages between 10 and 90 days old, you must submit a historical search request, which takes time to process.

Can I export Microsoft 365 Defender email reports to Excel?

Yes, within the Microsoft 365 Defender Email & collaboration reports, you can usually use the Export button to download the data as a .csv file, which can be easily analyzed in WPS Spreadsheet or Microsoft Excel.

Is there an API to get email security data older than 90 days?

Programmatic API access to email data older than 90 days is currently limited. Administrators are advised to rely on the Defender portal's visual reporting features and monitor the Microsoft 365 roadmap for future API enhancements.

Microsoft Office Security Issues