KQL To Calculate Tenant External Recipient Rate Limit
Query
// Tenant External Recipient Rate Limit or TERR
// https://techcommunity.microsoft.com/blog/exchange/introducing-exchange-online-tenant-outbound-email-limits/4372797
EmailEvents
| where Timestamp > ago(30d)
| where EmailDirection == "Outbound"
| summarize OutboundEmailVol=count() by bin(Timestamp,1d)
| sort by OutboundEmailVol descExplanation
This query is analyzing email data to understand the volume of outbound emails sent from a tenant over the past 30 days. Here's a simple breakdown of what it does:
-
Data Source: It looks at the
EmailEventsdata, which contains information about email activities. -
Time Frame: It filters the data to include only events from the last 30 days.
-
Email Direction: It further filters the data to focus only on outbound emails, meaning emails sent out from the tenant.
-
Summarization: It counts the number of outbound emails sent each day.
-
Sorting: It sorts the results in descending order based on the daily volume of outbound emails, so the days with the highest email volumes appear first.
In essence, this query helps identify the days with the highest outbound email activity over the past month.
Details
Steven Lim
Released: February 25, 2025
Tables
Keywords
Operators