Use mail protection reports to view data about malware, spam, and rule detections in Exchange Online

If you're an Exchange Online or Exchange Online Protection (EOP) admin, there's a good chance you'd like to monitor how much spam and malware is being detected, or how often your mail flow rules (also known as transport rules) are being matched. With the interactive mail protection reports in the Microsoft 365 security center, you can quickly get a visual report of summary data, and drill-down into details about individual messages, for as far back as 90 days.

Reports in the Microsoft Defender portal

In the Microsoft Defender portal (, go to Reports > Email & collaboration > Email & collaboration reports. and sign in using your work or school account. Or, to go directly to the Email & collaboration reports page, use


You must be a global administrator or have appropriate permissions assigned in order to use the Microsoft Defender portal. For details, see Permissions in the Microsoft Defender portal.

Reporting overview

The following table describes the types of reports that are available, how to find them, and where to go to learn more.

Type of information Learn more
Email security reports: Malware, spam, spoof and other protection reports for all Exchange Online organizations. View email security reports in the Microsoft Defender portal
View Defender for Office 365 reports in the Microsoft Defender portal: Mail latency, threat protection and other reports that are available to organizations with Defender for Office 365 (include in a subscription or as an add-on). View reports for Microsoft Defender for Office 365