Blog Post

Microsoft Security Community Blog
3 MIN READ

Microsoft Exchange Online: Search-MailboxAuditLog and New-MailboxAuditLogSearch will retire

ColbyBoone's avatar
ColbyBoone
Icon for Microsoft rankMicrosoft
Jan 14, 2025

As part of our ongoing efforts to improve the logging capabilities of Exchange Online, we are sharing our timeline for decommissioning the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets.

Important Update The licensing for the migration tool related to the deprecation of the Search-MailboxAuditLog cmdlet is specifically designed for customers with extended audit log retention set ...
Updated Mar 06, 2025
Version 3.0
audit
melaniekremer212's avatar
melaniekremer212
Copper Contributor
Jan 27, 2025

How will this impact advanced auditing on shared mailboxes?  I regularly have to search shared mailboxes for "who deleted this email" and that is not available in the unified log. 

  • RaksChauhan's avatar
    RaksChauhan
    Brass Contributor
    Jan 27, 2025

    melaniekremer212- i asked this question last year when they first proposed the changes as we use this extensively too. MS advised this is the new method, which i find makes things super complicated. Link here for Shared Mailboxes: 

    https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios#search-for-mailbox-activities-performed-in-a-specific-mailbox-including-shared-mailboxes

    • ColbyBoone's avatar
      ColbyBoone
      Icon for Microsoft rankMicrosoft
      Jan 31, 2025

      Hi RaksChauhan, 

      Thank you for your comment. We can confirm that the documentation you provided is correct. We understand that the changes might seem challenging. 

      Could you please share any specific feedback on how we can improve the documentation? Your insights would be very helpful.