Get-QuarantineMessageReport

<#
.SYNOPSIS
    Summarizes quarantined messages over a given period.

.DESCRIPTION
    Pulls quarantined messages for the last N days and groups them by
    quarantine reason and recipient, so a spike in phishing or bulk mail
    quarantine is visible immediately instead of during a monthly review.

.PARAMETER Days
    How many days back to look. Defaults to 7.

.EXAMPLE
    .\Get-QuarantineMessageReport.ps1 -Days 14

.NOTES
    Requires ExchangeOnlineManagement and an active Connect-ExchangeOnline session
    with Defender for Office 365 permissions.

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$Days = 7
)

$startDate = (Get-Date).AddDays(-$Days)
$messages = Get-QuarantineMessage -StartReceivedDate $startDate -EndReceivedDate (Get-Date)

Write-Host "Quarantined messages in the last $Days day(s): $($messages.Count)" -ForegroundColor Cyan

$messages | Group-Object QuarantineTypes | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize

$messages | Group-Object RecipientAddress | Sort-Object Count -Descending |
    Select-Object -First 10 Name, Count | Format-Table -AutoSize