> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Monthly Email Security Report per Client

> Spam, phishing and malware counts for every client's Microsoft 365 tenant, by delivery action, refreshed each month on a dashboard

The numbers come from the same Exchange Online reports as Microsoft's **Threat protection status** and **Mailflow status** pages in the Defender portal, read for each client tenant Neo can reach. Nothing is changed in any tenant.

## What you get

* One row per client, for the previous calendar month: spam, phishing and malware totals, each message counted once, by the main threat Microsoft found in it.
* The same detections broken down by delivery action: quarantined, sent to Junk, delivered, blocked or rejected, as far as the client's licence reports them.
* A filter on the client column, so an account manager can show one client their own numbers.

Microsoft counts per recipient: a message sent to five people counts five times, in its reports and here.

## Before you start

* **Each client's tenant is connected to Neo**: on the **Companies** page the company shows access granted (**Grant access**, or through [GDAP](https://docs.neoagent.io/integrations/m365/gdap.md)). A client Neo cannot reach shows an error on its row; the other clients still load.
* **Licensing**: every Exchange Online tenant has the spam, phishing and malware counts. Safe Links, Safe Attachments, impersonation protection and zero-hour auto purge numbers need Microsoft Defender for Office 365 Plan 1 or 2 (Microsoft 365 Business Premium includes Plan 1). A tenant without it shows no rows for those, which is not an error.
* **Retention**: Microsoft keeps these reports for 90 days. The previous month is always there; a month older than 90 days cannot be read, so keep the schedule running to build up history.
* **Exchange Online only**: a client whose mailboxes are on Exchange Server (on-premises) has no Microsoft email security reports.

## Set it up

**1. Ask Neo Support for the dashboard**

Open [**Dashboards**](https://dashboard.neoagent.io/dashboards), click **New dashboard**, and ask:

```
Build a dashboard of last month's email security numbers for every client
whose Microsoft 365 tenant is connected. Per client: spam, phishing and
malware totals from the Mailflow status report, and the same detections
broken down by delivery action (quarantine, junk, delivered, blocked) from
the Threat protection status report. Add a client filter, and refresh it
on the 1st of every month at 07:00.
```

Neo Support writes the read, adds the **Mail Flow & Transport** Exchange permission group and the **End Companies** Neo API group to the dashboard, and runs it once against your live data.

**2. Check one client against the Defender portal**

Pick one client and open its tenant's [Mailflow status report](https://security.microsoft.com/reports/mailflowStatusReport) in the Defender portal for the same month, direction **Inbound**. Its spam, phishing and malware counts should match the dashboard's totals for that client. The Threat protection status report can show fewer, because zero-hour auto purge removes some messages after delivery. If the totals differ, ask Neo Support on the dashboard: "the phishing total for this client does not match the Defender portal".

**3. Share it**

Use **Share** for a link a client can open, or keep it to your team. See [Dashboards](https://docs.neoagent.io/product/dashboards.md).

## Variations

### A report your agent sends

To mail or post the numbers instead, ask Neo Support for a scheduled agent with the **Mail Flow & Transport** Exchange permission group at **Read Only**. It reads the same reports through [Execute PowerShell (Exchange)](https://docs.neoagent.io/agents/tools/m365/execute-powershell-exchange.md).

### Other email security reports

The same permission group reads zero-hour auto purge, Safe Links clicks, spoofed senders and users Microsoft restricted for sending spam. Ask for any of them by name.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.