How to report on which mobile devices are using the Outlook app (and why it’s important)
A recent post on the Microsoft Tech Community reminded me about a topic I wanted to discuss for a while now – Outlook mobile app licensing requirements, and how to make sure you are not violating them. Contrary to what the Microsoft marketing folks will have you believe, the app is not free for commercial use, as explicitly stated in the Outlook for iOS and Android in Exchange Online: FAQ on TechNet:
Q: Is a license required to use Outlook for iOS and Android?
A: Outlook for iOS and Android is free for consumer usage from the iOS App store and from Google Play. However, commercial users require an Office 365 subscription that includes the Office applications (either Business, Business Premium, Enterprise E3, E5, ProPlus, or the corresponding versions of those plans for Government or Education).
If you only have a Kiosk license, a standalone Exchange Online license (without Office) or an Exchange on-premises (Exchange Server) license, you will be violating the license agreement if you continue to use the Outlook app. Despite this, the Outlook application will happily continue working even with such licenses, as the code does not enforce any license requirements.
The question every Office 365 administrator should ask then is whether their users are compliant with the above requirements, and in order to answer that question, first you’ll need to generate a report of all the mobile devices using the Outlook app. There are several different methods for doing this:
Use the Office 365 Admin Center.
Simply navigate to the Reports section on the left, expand the Usage reports and select Email App Usage. Make sure the Outlook (mobile) column is displayed – if not, you can add it via the columns menu if needed. You could also export the report to get all the data.
It’s important to note that this report doesn’t give you any data about the license used, so you will have to either check it manually against each user, or correlate it via the other reports.
Next option: PowerShell
You can also use PowerShell to generate this type of report, and here’s how. There are a few different ways to do this. First, we will try to follow some good practices and make sure that the report we are generating will include only the data we need, which in turn means using server-side filtering instead of looping over each mailbox/device. There are several ways to use the filters:
Use the -Filter parameter with the DeviceType attribute:
Get-MobileDevice -Filter {DeviceType -eq “Outlook”}
Use the -Filter parameter with the DeviceModel attribute:
Get-MobileDevice -Filter {DeviceModel -eq “Outlook for iOS and Android”}
Use the -RestApi cmdlet switch, which in turn will filter only the devices using the REST API.
This is the method all Office 365 accounts should be using (since the move to the new Office 365-based architecture back in June 2017) so the filter should be equivalent to the above ones.
Get-MobileDevice -RestApi
Those of you that have worked with the Get-MobileDevice cmdlet previously are probably aware that the output will be lacking some basic details. While it will certainly return information about the devices in question, getting the actual user is trickier – this method only exposes the user Display Name and some other composite properties. Still, it’s relatively easy to get the information and I would advise using the DistinguishedName as it uniquely identifies the user. Here’s how:
Get-MobileDevice -RestApi -ResultSize Unlimited | select UserDisplayName,@{n=”User”;e={$_.DistinguishedName.Split(“,”)[2..10] -join “,”}},DeviceType,FirstSyncTime,DeviceAccessState*,ClientType
While it could be argued that this isn’t as good looking as including a UPN, it does the job and is fast – it avoids the need for any additional cmdlet runs. However, if we wanted to include licensing info, we don’t have any option but to run additional cmdlets – unless you want to handle this via Excel lookups, or similar. Here’s an example of how to get this additional information by using the Get-Mailbox cmdlet and its PersistedCapabilities property, which exposes (some of the) relevant licensing information:
$OutlookDevices = Get-MobileDevice -RestApi -ResultSize Unlimited
foreach ($device in $OutlookDevices) {
$mailbox = Get-Mailbox ($device.DistinguishedName.Split(“,”)[2..10] -join “,”)
$device | Add-Member -MemberType NoteProperty -Name UserPrincipalName -Value $mailbox.UserPrincipalName
$device | Add-Member -MemberType NoteProperty -Name License -Value ($mailbox.PersistedCapabilities -join “;”)
}
$OutlookDevices | select UserDisplayName,UserPrincipalName,License,DeviceType,FirstSyncTime,DeviceAccessState*,ClientType
This is better, but still not perfect. If you want the actual license information from Azure AD, you will need to run the Get-MsolUser/Get-AzureADUser cmdlet. Since we’re adding more and more cmdlets here, we might as well add some additional details – exposed via the Get-MobileDeviceStatistics cmdlet. Here’s our final reporting script:
$OutlookDevices = Get-MobileDevice -RestApi -ResultSize Unlimited
foreach ($device in $OutlookDevices) {
$mailbox = Get-Mailbox ($device.DistinguishedName.Split(“,”)[2..10] -join “,”)
$device | Add-Member -MemberType NoteProperty -Name UserPrincipalName -Value $mailbox.UserPrincipalName
$devicestats = Get-MobileDeviceStatistics -Identity $device.DistinguishedName
$device | Add-Member -MemberType NoteProperty -Name LastSuccessSync -Value $devicestats.LastSuccessSync
$device | Add-Member -MemberType NoteProperty -Name Status -Value $devicestats.Status
$device | Add-Member -MemberType NoteProperty -Name DevicePolicyApplicationStatus -Value $devicestats.DevicePolicyApplicationStatus
$license = Get-MsolUser -UserPrincipalName $mailbox.UserPrincipalName
$device | Add-Member -MemberType NoteProperty -Name License -Value ((Get-MsolUser -UserPrincipalName $mailbox.UserPrincipalName).Licenses.ServiceStatus | ? {$_.ServicePlan.ServiceName -like “Exchange_?_*” -and $_.ServicePlan.TargetClass -eq “User”}).ServicePlan.ServiceName
}
$OutlookDevices | select UserDisplayName,UserPrincipalName,License,DeviceType,FirstSyncTime,LastSuccessSync,Status,DevicePolicyApplicationStatus,DeviceAccessState*,ClientType
Additional properties can be added to this script as required, however it’s important to remember that the more additional cmdlets you run, the slower the script will be, and it will be more prone to throttling and disconnects. In which case, you might as well consider going the Excel route, or even better yet – you could use third-party Office 365 reporting software such as Radar Reporting, which run and generate fully formatted, customizable reports – so adding additional user/license columns takes a few clicks and it’s instant, so there’s no additional wait time.