Office-docs-powershell: Get-MailDetailATPReport - Issues with Startdate & Endate

[AlanPS1]

The docs linked below mention: "Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM"."

Get-MailDetailATPReport

Using Get-Culture, the following data is populated:

Name: en-US
IetfLanguageTag: en-US
ShortDatePattern: M/d/yyyy
ShortTimePattern: h:mm tt

I am running the following:

Get-MailDetailATPReport -Direction Inbound -StartDate "30/10/2020 12:00 PM" -EndDate "30/10/2020 12:01 PM" -pagesize 5000 -page 1

The results should be for 1 minute, but infact return a 24 hour period. Is there anyone else having issues with this?

NB: I am testing this using the short date & short time format for both en-US & en-GB and I cannot seem to return less than 24 hours of results with what should be the accurate format for each region in line with the docs.

I ask as you will see that the results are restricted to 10,000 results. a 24h hour period returns more that 10,000 results so it would be helpful for the time value to be returning as I'd expect within -StartDate and -Enddate as restricting the results using -EventType or other doesn't fit the bill for the current task I have.

Are any others having issues with this?

[AlanPS1]

Hi @yogkumgit . How are you getting on. Are you finding any potential solutions here or am I missing anything?

Thanks in advance for taking the time to have a look.

Alan

[dariomws]

Hi @AlanPS1, thank you for your feedback and help us to improve docs.microsoft.com.

Unfortunately, I don't have a tenant where I can test the functionality of this cmdlet. So for this inquiry, I need to kindly suggest opening a support ticket directly from your tenant's administration. They will be able to help better. Then, if there is some update to apply to the article I can do it.

Support URL: https://docs.microsoft.com/microsoft-365/admin/contact-support-for-business-products.

Hope you understand.

[AlanPS1]

Hi @dariomws . I actually have one open already on this. They suggest updating the docs to reflect that the time cannot be evaluated. My concern is that without filtering using -EventType then the results are constrained to 10,000 results. This would be more manageable if there were an easy way to get an accurate list of all event types but I'm not sure that is available. I compared the event types I return and some are missing from Get-MailDetailATPReport docs.

Is there a way that I can have someone look at how the cmdlet performs? An enhancement to allow -StartDate & -EndDate filter on times as well as date to get these results below 10,000. Or, as I have asked MS Support, could the results be increased to 1,000,000 perhaps?

[dariomws]

Hi @AlanPS1, thank you again for your feedback.

I think the best place to get help with this cmdlet is support, as I'm not able to check it together with you. I think you should work with them to report this feedback because I think -StartDate and -EndDate should work as it's documented.
Also, if you want to suggest new features, the best place is user voice:
https://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/41346508-get-maildetailatpreport-increase-result-limit

My apologies but we are limited to documentation issues and improvements.

[yogkumgit]

@dariomws Thank you very much for the contribution and sharing this explanation. @AlanPS1 Hope this comment is helpful for you. Considering the nature of the issue, as advised, please open a service ticket in your tenant and follow with them for the resolution. We proceed here to close it.
We will be very happy if you can share the outcome or resolution with us if you see documentation update is required. We will certainly update this documentation with that valuable information. Thanks again, for taking out some time to open the issue. Appreciate and encourage you to do the same in future also.

[AlanPS1]

Hi @yogkumgit . Did you manage to test it at all? I have a service ticket open but no further forward yet I'm afraid.

[dariomws]

Hi @AlanPS1,

My apologies but we cannot test it and help you here. The best way to work on this issue is by working together with support, as I cannot support you or work together in a shared session.

We'll proceed to close this issue. After the support ticket is closed if there is something to update in the article share the outcome or resolution and the ticket number.

Thank you again!

[AlanPS1]

No problem @dariomws. I chased it up earlier so I will definitely feed back any outcomes. Thanks again for your assistance and input.

Thanks, Alan