Forum Discussion
Reyncat
Apr 05, 2022Copper Contributor
Exchange Online - In-Place Holds Audit logs
Hello,
I am looking for the log which would contain the event when an In-Place hold GUID is stamped onto a mailbox.
Mailbox audit logs and Unified audit logs have not been any help. It seems that when a case is created in compliance center, there is some back-end process that stamps the GUID of the case to the In-Place hold attribute on the mailbox. I'm looking for the time that this happens on the actual mailbox.
Our legal team wants to be able to defend when the actual hold is placed on a mailbox and when it is removed. I can't seem to find when this happens. Only that it did happen.
Any thoughts?
Thanks!
- Unified audit log should be the place to look, keep in mind that event appear with some delay therein (in some cases days).
- Tom_R_Brass Contributor
Hi, Yes it looks like I can see audit information from when the Compliance Center creates the case and adds the "Exchangelocation" to the case hold. But, This looks like it is from the Compliance Center side. I am specifically looking for the time and event where Exchange stamps the Guid of the case to the mailbox InPlace hold attribute. It's my understanding that the Compliance Center and Exchange are two different systems and that the Compliance Center 'tells' Exchange to place the hold on the mailbox. I want the event where Exchange does what the Compliance Center tells it too.
- I'm not sure whether this one is logged, as it's likely considered part of the internal sync processes. You can run an admin audit search in Exchange Online, if there is any event captured you'll likely find it under the "external admin" section.