Skip to main content

Microsoft 365 | Users Exceeding Mailbox Issue Warning Quota Alerts

Mailbox Quota, Microsoft 365, Exchange Online, PowerShell, Liongard, Troubleshooting, Alerts, Actionable Alerts, Mailbox

Overview 💥

This article explains what the Liongard Users Exceeding Mailbox Issue Warning Quota alert means, how Liongard determines the mailQuotaExceeded_r flag, step-by-step validation (GUI + PowerShell), common causes of false positives, remediation actions, a decision flow, and EXACT commands and expected outputs you can use when troubleshooting.
​

Liongard does not compute quota thresholds. Liongard retrieves mailbox usage and quota-related reporting information from Microsoft Graph v1.0 reporting endpoints. If Microsoft reports a mailbox as IssueWarning (or worse) within Graph reporting data, Liongard reports mailQuotaExceeded_r: true.

Important: Microsoft Graph reporting data may not always be real-time and can experience reporting delays depending on Microsoft processing intervals.


Example Alert :

How mailbox quotas work 🤔

Each mailbox in Exchange/Exchange Online has three main thresholds:

  • IssueWarningQuota — soft warning threshold; user receives warning when exceeded.

  • ProhibitSendQuota — hard limit; user cannot send new mail.

  • ProhibitSendReceiveQuota — hard stop; user cannot send or receive.

Microsoft exposes a per-mailbox status called StorageLimitStatus with values:

  • BelowLimit

  • IssueWarning

  • ProhibitSend

  • ProhibitSendReceive

Liongard maps these to the boolean mailQuotaExceeded_r:

  • BelowLimit → mailQuotaExceeded_r: false

  • IssueWarning / ProhibitSend / ProhibitSendReceive → mailQuotaExceeded_r: true

Default capacities (typical, tenant-dependent):

  • Exchange Online Plan 1 (E1): ~50 GB

  • Exchange Online Plan 2 / E3 / E5: ~100 GB

NOTE: Admins can set custom quotas per mailbox — always verify the mailbox’s actual thresholds.

Validation steps 👨‍💻

Perform these steps to determine whether the alert is true or a false positive.

1) Capture context (always)

  • Record the Liongard Data Print entry that triggered the alert (include the collection timestamp).

  • Note the affected user (example: xyz@ab.com) and the alert timestamp.

2) Quick check on Microsoft 365 Admin Center

  1. Sign in to the Microsoft 365 Admin Center: https://admin.microsoft.com.

  2. Go to Users → Active users → select the user (xyz@ab.com).

  3. Open Mail → Mailbox usage (or Exchange Admin Center → Recipients → Mailboxes → select user → Storage).

  4. Note Current size and the three quota values (Issue Warning / Prohibit Send / Prohibit Send/Receive).

  5. If usage < IssueWarningQuota, proceed to PowerShell validation.
    ​

3) PowerShell (recommended)

Liongard retrieves mailbox usage and quota information using Microsoft Graph v1.0 Reports APIs.
For the most accurate comparison with what Liongard displays, validate the data directly through Microsoft Graph instead of Exchange Online PowerShell.

Requirements

  • Microsoft Graph PowerShell SDK installed

  • Account with appropriate Microsoft Graph reporting permissions

  • Reports.Read.All permission scope

➡️ Install the Graph module if needed:

Install-Module Microsoft.Graph -Scope CurrentUser

➡️ Connect to Microsoft Graph

Open PowerShell in elevated/admin mode and run:

Connect-MgGraph -Scopes "Reports.Read.All"

➡️ Export Mailbox Usage Report

Run the following command:

Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/v1.0/reports/getMailboxUsageDetail(period='D7')" `
-OutputFilePath "$env:USERPROFILE\Desktop\MailboxUsageDetail.csv"

This generates a CSV file on the desktop named:

MailboxUsageDetail.csv

➡️ Compare Results with Liongard

Review the CSV output and compare the following values against the Liongard Microsoft 365 Inspector:

  • User Principal Name

  • Storage Used

  • Warning Quota

  • Prohibit Send Quota

  • Mailbox Status

Because Liongard uses Microsoft Graph v1.0 report data, the CSV output should closely align with the Inspector results.

Important Notes 🚨

Microsoft Graph Reporting Data Is Delayed

Microsoft Graph mailbox usage reports are not always real-time and may contain reporting delays depending on Microsoft processing intervals.

Exchange Online PowerShell May Return Different Values

Exchange Online PowerShell can return live mailbox configuration values that differ from Microsoft Graph reporting data.

Since Liongard relies on Microsoft Graph v1.0 reporting endpoints, Graph-based validation should be considered the authoritative comparison source for this Inspector.

References

Note : This article references external Microsoft resources and tools. Liongard does not control availability, functionality, or accuracy of third-party sites. Use them as optional reference resources.

Remediation & recommended partner actions 😉

If true positive (StorageLimitStatus = IssueWarning or worse):

  • Clean the mailbox: remove large attachments, empty Deleted Items, archive messages.

  • Enable or confirm auto-expanding archive (if eligible).

  • Increase mailbox quota or upgrade license if appropriate.

If false positive (StorageLimitStatus = BelowLimit but Liongard shows true):

  • Re-run the Liongard Microsoft 365 inspector immediately to refresh the snapshot.

  • If the alert persists: collect evidence (see Contact Support below) and open a support case.

Mailbox usage discrepancies between Liongard and Microsoft 365 🤯

Differences don't mean the alert is wrong — only that Liongard and Microsoft are reporting from different data sets or time windows.

Why this happens

Microsoft’s Graph API reports mailbox usage metrics in pre-defined aggregation intervals: 7 days, 30 days, 90 days, 180 days. Liongard uses the 7-day interval for mailbox usage. That means Liongard shows a 7-day aggregated / averaged value — not a single-day, up-to-the-minute snapshot.

Practical implications

  • The Admin Center may show today’s exact usage, while Liongard may reflect a 7-day average (higher if a spike occurred earlier in the week).

  • Example: Admin Center shows 34% used (713 MB), but Liongard (7-day) shows 98% if there was a large spike within the 7-day window.

Other causes

  • Timing of data refresh — Liongard runs on a schedule; if usage dropped after the last run, the alert can remain until the next collection.

  • Quota threshold differences — custom quotas produce different behaviors.

Conclusion: This is typically an aggregation/refresh difference, not a bug. For the most accurate comparison with Liongard Inspector output, validate mailbox usage through Microsoft Graph mailbox reporting exports, since Liongard relies on Microsoft Graph v1.0 reporting endpoints.

Contact Support 🦁

If you determine the alert is a false positive (Liongard true but Microsoft BelowLimit) and you want Liongard Support to investigate, collect all of the following and attach them to your support ticket:

  1. Screenshots :

    • Alert received from Liongard for Exceeding Mailbox Issue Quota

    • Admin Center mailbox usage page showing current size & quota.

    • Microsoft Graph PowerShell output or exported MailboxUsageDetail.csv results.

  2. Scope & frequency:

    • Is it one mailbox or many?

    • When did the alert first appear? Is it recurring?

  3. Actions you attempted:

    • Re-ran Liongard inspector? (Yes/No)

    • Any mailbox cleanup / quota changes performed after receiving the initial alert?

Did this answer your question?