Forum Discussion

skipster311-175's avatar
skipster311-175
Copper Contributor
Oct 12, 2022

Audit safe senders

I have AdminAuditLogConfig  enabled. I need to find out when a particular user either removed or added a sender to the users "safe senders" list in outlook. How can i accomplish this ? This is for exchange online

exchange online
office 365

3 Replies

Sort By
  • VasilMichev's avatar
    VasilMichev
    MVP
    Oct 12, 2022
    I'm not sure user's own operations against the safe sender list are being audited. If the action was performed by another user/admin, it should come up when you search the audit log for any Set-MailboxJunkEmailConfiguration entries.
    • skipster311-175's avatar
      skipster311-175
      Copper Contributor
      Oct 12, 2022
      If the change was made to the users safe-senders list it would have been made by the user , not an admin.
      • VasilMichev's avatar
        VasilMichev
        MVP
        Oct 13, 2022
        I'm not able to see any audit events generated for owner's changes to the safe sender's list, best open a support case to confirm whether this is expected to generate an audit trail.

Resources