Forum Discussion
non owner mailbox access report
How do I get the audit logs to report non-owner mailbox access in exchange online?
Since the feature disappeared in the Exchange admin center, I've tried using Purview Audit logs to no results other than when the owner accesses their own mailbox.
I've tried a few attempts at using powershell, also with no avail.
5 Replies
- this is a pain in the arse, until today not a proper response over this from MS.
- I have contact Microsoft support regarding this missing options in the new Admin console and they've told me that it moved to the compliance center/Purview but couldn't showed me exactly where, so they recommended to use ExchangeOnline PowerShell command Search-MailboxAuditLog.
https://learn.microsoft.com/fr-fr/powershell/module/exchange/search-mailboxauditlog?view=exchange-ps
Here is an example:
Search-MailboxAuditLog email address removed for privacy reasons -StartDate "xx/xx/2024" -EndDate "xx/xx/2024" -ShowDetails
I usually add a | Out-GridHtml at the end to make it more readable. - Did you find a solution? I also want to get all actions that happened on a mailbox after a folder disappeared. And i cannot find the right command/gui setup.
- I have the same question on it. Can anyone answer it?
I tried looking today also for this but I used DarthVador example. Under Other Features I see Auditing was moved to Purview but where I cannot say. 🤷
