Forum Discussion

Charlie933's avatar
Charlie933
Copper Contributor
Dec 04, 2023
Solved

Find Audit logs of a mailbox

We have noticed that mailboxes of couple of users are converted to shared mailboxes and send as permissions are added to random users in our tenant. We have run a audit search from compliance.microso...
admin
exchange online
office 365
outlook
  • VasilMichev's avatar
    VasilMichev
    Dec 04, 2023
    Exchange admin operations are also covered by the Unified audit log, so you probably need to expand your filters. The entries are stored as the actual cmdlet being run, which in this case should be Set-Mailbox.

    You can run a more targeted search via PowerShell:

    Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-365) -EndDate (Get-Date).AddDays(1) -ResultSize 5 -FreeText "Type" -RecordType 1 -Operations Set-Mailbox
  • Charlie933's avatar
    Charlie933
    Copper Contributor
    Dec 05, 2023

    Hi @Andres,

    Thanks for your response. I have been through the mentioned documentation and tried running the powershell command "Search-AdminAuditLog -Cmdlets Set-Mailbox -StartDate (Get-Date).AddDays(-365) -EndDate (Get-Date).AddDays(1)" and it returned all the exchange admin activities over the last 90 days. However, we were able to recognise few of the entries as planned activities but there are many entires similar to the mentioned below. We did notice that object modified is returning object-ids inside {} of objectmodified field of the output and cross verified it with the object-ids of the users which are in question but they do not match for any of them.

    ObjectModified : NAMPR19A003.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/xx.onmicrosoft.com/SystemMailbox{object-id}
    CmdletName : Set-Mailbox
    CmdletParameters : {RecoverableItemsQuota, Force, Arbitration, ProhibitSendQuota...}
    ModifiedProperties : {} (empty in the output itself)
    Caller : ********
    ExternalAccess : True
    Succeeded : True
    Error :
    RunDate : 06-09-2023 09:08:37
    OriginatingServer : 
    ClientIP :
    SessionId :
    AppId :
    ClientAppId :
    Identity :
    IsValid : True
    ObjectState : New


    Also why is outlook making changes and why do some results have "*******" (actual entries and not censored for privacy) and "NT AUTHORITY\SYSTEM (Microsoft.Exchange.AdminApi.NetCore)" in the "caller" field?

    Thanks,
    Charlie933

    • VasilMichev's avatar
      VasilMichev
      MVP
      Dec 05, 2023
      Those are "external" or "system" entries, you can filter them out.

      Search-AdminAuditLog -Cmdlets Set-Mailbox -Parameters Type -StartDate (Get-Date).AddDays(-100) -EndDate (Get-Date) -ResultSize 5 -ExternalAccess:$false

      If you are looking for the changes made against specific mailbox, also add the -ObjectIds parameter:

      Search-AdminAuditLog -Cmdlets Set-Mailbox -Parameters Type -StartDate (Get-Date).AddDays(-100) -EndDate (Get-Date) -ResultSize 5 -ExternalAccess:$false -ObjectIds shared2020
      • Charlie933's avatar
        Charlie933
        Copper Contributor
        Dec 05, 2023
        VasilMichev below commands returns empty for both UPN and azure objectid.

        Search-AdminAuditLog -Cmdlets Set-Mailbox -Parameters Type -StartDate (Get-Date).AddDays(-100) -EndDate (Get-Date) -ResultSize 10 -ExternalAccess:$false -ObjectIds abs@domain

        I have Exchange and Group Administrator roles assigned. Does -objectids flag require any additional permissions? because the command seems to be working without -objectids flag but still we do not get the logs of mailboxes we are looking for.

        Thanks,
        Charlie933