Microsoft 365 | Users Exceeding Mailbox Issue Warning Quota Alerts

Overview 💥

This article explains what the Liongard Users Exceeding Mailbox Issue Warning Quota alert means, how Liongard determines the mailQuotaExceeded_r flag, step-by-step validation (GUI + PowerShell), common causes of false positives, remediation actions, a decision flow, and EXACT commands and expected outputs you can use when troubleshooting.

Important: Liongard does not compute quota thresholds. We reflect Microsoft’s StorageLimitStatus (via Exchange/Graph APIs). If Microsoft reports IssueWarning (or worse), Liongard reports mailQuotaExceeded_r: true.

Example Alert :

How mailbox quotas work 🤔

Each mailbox in Exchange/Exchange Online has three main thresholds:

IssueWarningQuota — soft warning threshold; user receives warning when exceeded.
ProhibitSendQuota — hard limit; user cannot send new mail.
ProhibitSendReceiveQuota — hard stop; user cannot send or receive.

Microsoft exposes a per-mailbox status called StorageLimitStatus with values:

BelowLimit
IssueWarning
ProhibitSend
ProhibitSendReceive

Liongard maps these to the boolean mailQuotaExceeded_r:

BelowLimit → mailQuotaExceeded_r: false
IssueWarning / ProhibitSend / ProhibitSendReceive → mailQuotaExceeded_r: true

Default capacities (typical, tenant-dependent):

Exchange Online Plan 1 (E1): ~50 GB
Exchange Online Plan 2 / E3 / E5: ~100 GB

NOTE: Admins can set custom quotas per mailbox — always verify the mailbox’s actual thresholds.

Validation steps 👨‍💻

Perform these steps to determine whether the alert is true or a false positive.

1) Capture context (always)

Record the Liongard Data Print entry that triggered the alert (include the collection timestamp).
Note the affected user (example: xyz@ab.com) and the alert timestamp.

2) Quick check on Microsoft 365 Admin Center

Sign in to the Microsoft 365 Admin Center: https://admin.microsoft.com.
Go to Users → Active users → select the user (xyz@ab.com).
Open Mail → Mailbox usage (or Exchange Admin Center → Recipients → Mailboxes → select user → Storage).
Note Current size and the three quota values (Issue Warning / Prohibit Send / Prohibit Send/Receive).
If usage < IssueWarningQuota, proceed to PowerShell validation.

3) PowerShell — recommended

Use Exchange Online PowerShell. Open powershell in Elevated mode. Use the below commands:

Install module (one time):

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser -Force

Import module:

Import-Module ExchangeOnlineManagement

Connect to Exchange Online:

Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.com

Check mailbox usage & status:

Get-MailboxStatistics -Identity "xyz@ab.com" | Format-List DisplayName, TotalItemSize, StorageLimitStatus

Check mailbox usage & status:

Get-MailboxStatistics -Identity "xyz@ab.com" |
  Format-List DisplayName, TotalItemSize, StorageLimitStatus

Expected output (healthy):

DisplayName : XYZ User 
TotalItemSize : 713.6 MB (747,593,728 bytes) 
StorageLimitStatus : BelowLimit

Expected output (over warning):

DisplayName : XYZ User 
TotalItemSize : 1.95 GB (2,094,000,000 bytes) 
StorageLimitStatus : IssueWarning

Check the mailbox quota thresholds:

Get-Mailbox -Identity "xyz@ab.com" |
  Format-List IssueWarningQuota, ProhibitSendQuota, ProhibitSendReceiveQuota, RecipientTypeDetails

Expected output:

IssueWarningQuota        : 49.5 GB
ProhibitSendQuota        : 49.75 GB
ProhibitSendReceiveQuota : 50 GB
RecipientTypeDetails     : UserMailbox

4) Bulk check (optional)

Find all mailboxes not BelowLimit:

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  $mb = $_
  $stat = Get-MailboxStatistics -Identity $mb.Identity -ErrorAction SilentlyContinue
  if ($stat) {
    [PSCustomObject]@{
      DisplayName        = $mb.DisplayName
      PrimarySmtp        = $mb.PrimarySmtpAddress
      TotalItemSize      = $stat.TotalItemSize
      StorageLimitStatus = $stat.StorageLimitStatus
      IssueWarningQuota  = $mb.IssueWarningQuota
    }
  }
} | Where-Object { $_.StorageLimitStatus -ne 'BelowLimit' } | Format-Table -AutoSize

Expected output :

How to interpret results :

If StorageLimitStatus = BelowLimit
- Microsoft says the mailbox is under quota → Liongard should show mailQuotaExceeded_r: false.
- If Liongard shows true, likely causes: snapshot/timing mismatch, custom quota, or parsing issue. Re-run inspector and compare timestamps.
If StorageLimitStatus = IssueWarning or worse
- Microsoft flagged the mailbox → Liongard true is correct. Proceed with remediation.

Troubleshooting decision flow 🚀

Liongard shows mailQuotaExceeded_r: true.
Run Get-MailboxStatistics for the user.
- If result is IssueWarning / ProhibitSend / ProhibitSendReceive → True positive. Remediate.
- If result is BelowLimit → Possible false positive:
  - Compare Liongard collection timestamp vs. PowerShell run time.
  - Re-run Liongard Microsoft 365 inspector in Debug + Clear-Cache mode to force a fresh inspection to capture the latest details
  - If Liongard still shows true for the same timestamp, please reach out to support team with the above findings.

Remediation & recommended partner actions 😉

If true positive (StorageLimitStatus = IssueWarning or worse):

Clean the mailbox: remove large attachments, empty Deleted Items, archive messages.
Enable or confirm auto-expanding archive (if eligible).
Increase mailbox quota or upgrade license if appropriate.

If false positive (StorageLimitStatus = BelowLimit but Liongard shows true):

Re-run the Liongard Microsoft 365 inspector immediately to refresh the snapshot.
If the alert persists: collect evidence (see Contact Support below) and open a support case.

Mailbox usage discrepancies between Liongard and Microsoft 365 🤯

Differences don't mean the alert is wrong — only that Liongard and Microsoft are reporting from different data sets or time windows.

Why this happens

Microsoft’s Graph API reports mailbox usage metrics in pre-defined aggregation intervals: 7 days, 30 days, 90 days, 180 days. Liongard uses the 7-day interval for mailbox usage. That means Liongard shows a 7-day aggregated / averaged value — not a single-day, up-to-the-minute snapshot.

Practical implications

The Admin Center may show today’s exact usage, while Liongard may reflect a 7-day average (higher if a spike occurred earlier in the week).
Example: Admin Center shows 34% used (713 MB), but Liongard (7-day) shows 98% if there was a large spike within the 7-day window.

Other causes

Timing of data refresh — Liongard runs on a schedule; if usage dropped after the last run, the alert can remain until the next collection.
Quota threshold differences — custom quotas produce different behaviors.

Conclusion: This is typically an aggregation/refresh difference, not a bug. For quota-state validation always rely on StorageLimitStatus via PowerShell as the authoritative indicator.

What to include when reporting to Liongard Support

If you determine the alert is a false positive (Liongard true but Microsoft BelowLimit) and you want Liongard Support to investigate, collect all of the following and attach them to your support case:

Screenshots :
- Alert received from Liongard for Exceeding Mailbox Issue Quota
- Actionable alert rule configuration page:
  Admin > Actionable Alerts > Go to the same Actionable alert mentioned > Click on clone button(2 squares icon) > Take screenshot of whole page in 2 parts.
- Metric used in this alert to check the output of the metrics. To check which metric that actionable alert is using follow the steps mentioned below:
  Admin > Actionable alert > Search for your alert > Click on blue text under "Rule name" > Again click on Blue Text under "Conditions" and it will reflect you the metric in use> Kindly provide us the screenshot.
- Admin Center mailbox usage page showing current size & quota.
- PowerShell window showing the above commands and output.
Scope & frequency:
- Is it one mailbox or many?
- When did the alert first appear? Is it recurring?
Actions you attempted:
- Re-ran Liongard inspector? (Yes/No)
- Any mailbox cleanup / quota changes performed after receiving the initial alert?

Contact Support 🧑‍🏫

If you discover a false positive and want Liongard Support to investigate, follow the checklist above (Screenshots + scope + actions taken) and open a support ticket with us. Supplying the exact files and details above speeds up diagnosis and investigation process. The support team can precisely correlate Liongard collection snapshots with Microsoft API responses and determine whether this is a timing/sync/parsing issue or a broader problem.