Recipient Limit Report 1.0.1

First public release.

Recipient Limit Report reports the Exchange Online messages sent to more than 25 recipients — counted as Exchange Online counts them, a distribution list being one recipient — as CSV and HTML files, one row per Message ID. The report is the same as the one of Purview DLP Report; the source is the Exchange Online message trace.

Highlights

• Source: the Exchange Online message trace (Microsoft Graph), no DLP policy needed; works before and after a recipient limit is applied.
• Recipient count before distribution list expansion, and the recipient list as the sender addressed it, read from the route of the message.
• Local SQLite history beyond the 90 days of the message trace; restartable collection, no duplicates, within the tenant quota of 100 requests per 5 minutes.
• CSV + self-contained HTML report: filters, Top 10 senders, message details with the distribution lists; large periods split by day, week or rows.
• Certificate (app-only), client secret or interactive authentication; one read-only Graph permission, ExchangeMessageTrace.Read.All.
• Read-only for Microsoft 365.

Lab measurements

7 days of a load test from an empty database: 3 h 03 min — 13.2 million trace rows, 799,446 messages, 2,727 requests without any 429, 400,139 messages over 25 recipients, report written in 43 s. On the 48-hour comparison window of Purview DLP Report, every DLP message is found with the same recipient count.

Download

RecipientLimitReport-1.0.1.zip contains only the files needed to run (no database, empty configuration) and the administrator guide as HTML. Unblock the files after download: Get-ChildItem "C:\Chemin\Du\Dossier" -Recurse -File -Force | Unblock-File.

Requirements

PowerShell 7.4+ · Microsoft Graph ExchangeMessageTrace.Read.All · the service principal of the message trace service in the tenant · Windows Terminal recommended.

See CHANGELOG.md for the details.