Reference

Mailbox

All Exchange mailboxes of your users, rooms & equipment

Part of the Exchange inventory.

Scan settings

Default scanning intervalAllowed scanning intervalsData removal during incremental scan
MonthlyDaily, Weekly, Bi-Weekly, Monthly, Never, InitialYes

Properties

Property Type Description Automation placeholder
ActiveSync Enabled Boolean Whether Exchange ActiveSync is enabled. {{Mailbox.ActiveSyncEnabled}}
Auto-Reply External Audience String Audience that receives the user's external auto-reply: 'none', 'contactsOnly', or 'all'. Allowed values: all, contactsOnly, none. {{Mailbox.AutoReplyExternalAudience}}
Auto-Reply Status String Indicates whether the user's automatic reply (out-of-office) is disabled, scheduled, or always enabled. Allowed values: alwaysEnabled, disabled, scheduled. {{Mailbox.AutoReplyStatus}}
Initially Scanned DateTime Shows when this object was initially found in a scan. {{Mailbox.CreatedTime}}
Delegate Meeting Delivery String How meeting messages are delivered when the mailbox has delegates. {{Mailbox.DelegateMeetingDelivery}}
Deleted Item Count Int32 Total number of deleted items in the mailbox {{Mailbox.DeletedItemCount}}
Deleted Item Quota Int64 Maximum storage size for deleted items in the mailbox {{Mailbox.DeletedItemQuota}}
Deleted Item Size Int64 The total size of all deleted items in the mailbox {{Mailbox.DeletedItemSize}}
Deleted User Deleted User Deleted user connected to the mailbox {{Mailbox.DeletedUser}}
Deleted user name String {{Mailbox.DeletedUserName}}
Deliver To Mailbox And Forward Boolean When false with forwarding configured, mail is forwarded WITHOUT keeping a copy — silent exfil. {{Mailbox.DeliverToMailboxAndForward}}
Display Name String The full name of the user. {{Mailbox.DisplayName}}
Email String Email is the email address of the user {{Mailbox.Email}}
EWS Enabled Boolean Whether Exchange Web Services is enabled for this mailbox. {{Mailbox.EwsEnabled}}
Forwarding Address String Internal forwarding target (Get-Mailbox -ForwardingAddress). {{Mailbox.ForwardingAddress}}
Forwarding SMTP Address String External SMTP forwarding target (Get-Mailbox -ForwardingSmtpAddress). Top BEC indicator. {{Mailbox.ForwardingSmtpAddress}}
Has Archive Boolean Shows if the mailbox has an online archive enabled {{Mailbox.HasArchive}}
Has External Forwarding Boolean Convenience: ForwardingSmtpAddress is set OR ForwardingAddress points to an external recipient. {{Mailbox.HasExternalForwarding}}
Hidden From Address Lists Boolean {{Mailbox.HiddenFromAddressListsEnabled}}
IMAP Enabled Boolean Whether IMAP4 access is enabled. Legacy protocol — top BEC vector when left on. {{Mailbox.IMAPEnabled}}
In-Place Holds String[] Identifiers of in-place holds applied to the mailbox. {{Mailbox.InPlaceHolds}}
Is Inactive Mailbox Boolean Soft-deleted but retained mailbox (still consumes storage). {{Mailbox.IsInactiveMailbox}}
Issue Warning Quota Int64 This value sets the maximum storage limit before a warning is issued to the user. If the mailbox size reaches or exceeds the value specified, Exchange sends a warning message to the user. {{Mailbox.IssueWarningQuota}}
Item Count Int32 The total number of items in the mailbox. {{Mailbox.ItemCount}}
Last Activity Date DateTime Date the mailbox had an email send or read activity. {{Mailbox.LastActivityDate}}
Last scan update DateTime Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. {{Mailbox.LastModifiedTime}}
Litigation Hold Date DateTime {{Mailbox.LitigationHoldDate}}
Litigation Hold Enabled Boolean Whether the mailbox is on litigation hold. {{Mailbox.LitigationHoldEnabled}}
Litigation Hold Owner String {{Mailbox.LitigationHoldOwner}}
MAPI Enabled Boolean Whether MAPI (Outlook desktop) is enabled. {{Mailbox.MAPIEnabled}}
Id String {{Mailbox.MailBoxId}}
Mailbox Language String Locale configured for the mailbox (e.g. 'en-US'). {{Mailbox.MailboxLanguage}}
Mailbox Time Zone String Time zone configured for the mailbox. {{Mailbox.MailboxTimeZone}}
OWA Enabled Boolean Whether Outlook on the web is enabled for this mailbox. {{Mailbox.OWAEnabled}}
POP Enabled Boolean Whether POP3 access is enabled. Legacy protocol — top BEC vector when left on. {{Mailbox.POPEnabled}}
Percent of prohibit Send Quota Double Percentage reached for maximum storage until mailbox can not send any mails anymore because of reaching storage quota limit. {{Mailbox.PercentIssueSendQuota}}
Percent of prohibit Send/Receive Quota Double Percentage reached for maximum storage until mailbox can not send or receive any mails anymore because of reaching storage quota limit. {{Mailbox.PercentIssueSendReceiveQuota}}
Percent of prohibit Issue Warning Quota Double Percentage reached for maximum storage until warning will be shown that mailbox is reaching storage quota limit. {{Mailbox.PercentIssueWarningQuota}}
Prohibit Send Quota Int64 If the mailbox size reaches or exceeds the specified limit, Exchange prevents the user from sending new messages and displays a descriptive error message. {{Mailbox.ProhibitSendQuota}}
Prohibit Send/Receive Quota Int64 If the mailbox size reaches or exceeds the specified limit, Exchange prevents the mailbox user from sending new messages and won't deliver any new messages to the mailbox. Any messages sent to the mailbox are returned to the sender with a descriptive error message. {{Mailbox.ProhibitSendReceiveQuota}}
Read Count Int32 Mails read in report period. {{Mailbox.ReadCount}}
Receive Count Int32 Mails received in report period. {{Mailbox.ReceiveCount}}
Require Sender Authentication Boolean {{Mailbox.RequireSenderAuthenticationEnabled}}
Retention Hold Enabled Boolean {{Mailbox.RetentionHoldEnabled}}
Risk Score Int32 Stores risk score {{Mailbox.RiskScore}}
Risk Score Update DateTime Stores risk score update {{Mailbox.RiskScoreLastUpdate}}
Risk Score Value String Stores risk score value like Low_Low {{Mailbox.RiskScoreValue}}
Send Count Int32 Mails send in report period. {{Mailbox.SendCount}}
SMTP Client Authentication Disabled Boolean When false (or null with org default = false), legacy SMTP AUTH is allowed for this mailbox. {{Mailbox.SmtpClientAuthenticationDisabled}}
Storage Used Int64 Total storage used. {{Mailbox.StorageUsed}}
Universal Outlook Enabled Boolean Whether Outlook for iOS/Android (Universal Outlook) is enabled. {{Mailbox.UniversalOutlookEnabled}}
User User Exchange mailbox of the user {{Mailbox.User}}
User name String Email address of the user. {{Mailbox.UserName}}
User purpose String States if the mailbox belongs to a user or is a shared mailbox. Default scanning interval: Initial. {{Mailbox.UserPurpose}}

Relations

Relation Service Description
Calendar Permission Exchange Permissions configured on Exchange mailbox calendars (sharing and delegation).
Mailbox Delegate Exchange Mailbox delegations: Full Access, Send-As, and Send-on-Behalf permissions on user mailboxes.
Mailbox Folder Permission Exchange Per-folder ACLs on user mailboxes (Calendar, Inbox, Top of Information Store). Anonymous calendar sharing is a silent data leak no admin UI surfaces.
Redirect Rule Exchange All registered Exchange mailbox redirect rules
Deleted User Microsoft 365 All users that have been deleted from your tenant
User Microsoft 365 All users registered in your tenant (internal, external)

Segments

Segment Description
Archived Mailboxes Mailboxes that have an online archive enabled.
Mailboxes with Auto-Reply Mailboxes that have an automatic reply currently enabled or scheduled.
Inactive Mailboxes Mailboxes with no send/receive/read activity in the last 90 days.
Large Mailboxes Mailboxes whose total storage exceeds 50 GB.
Mailboxes Near Quota Mailboxes that have used more than 80% of their prohibit-send quota.
Room & Equipment Mailboxes Mailboxes whose purpose is a room or equipment resource.
Shared Mailboxes Shows mailboxes shared by multiple users
User mailboxes Shows mailboxes owned by single users

Actions

This object does currently not have any actions.

Policy Severity Description
Mailboxes with auto-reply always enabled Low Shows mailboxes whose automatic reply is set to 'always enabled' (no end date).
Mailboxes auto-replying to all external senders Medium Shows mailboxes whose auto-reply is enabled and configured to reply to all external senders.
Inactive mailboxes (90+ days) Medium Shows mailboxes that have not had any send/receive/read activity for more than 90 days.
Very large mailboxes (90+ GB) Low Shows mailboxes whose total storage exceeds 90 GB.
Large mailboxes without archive Medium Shows mailboxes larger than 50 GB that do not have an online archive enabled.
Mailboxes near storage quota High Shows mailboxes that have used more than 80% of their prohibit-send quota.
Mailboxes with external redirect rules High Shows mailboxes which have redirect rules that redirect to external domains
Shared mailboxes with high storage Medium Shows shared mailboxes that have used more than 60% of their prohibit-send quota.
Mailboxes with excessive redirect rules Medium Shows mailboxes with more than 10 redirect rules — a known attacker-persistence pattern.

Last updated: 7/19/2026