Forum Discussion
Solved
Find Audit logs of a mailbox
We have noticed that mailboxes of couple of users are converted to shared mailboxes and send as permissions are added to random users in our tenant. We have run a audit search from compliance.microso...
- Exchange admin operations are also covered by the Unified audit log, so you probably need to expand your filters. The entries are stored as the actual cmdlet being run, which in this case should be Set-Mailbox.
You can run a more targeted search via PowerShell:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-365) -EndDate (Get-Date).AddDays(1) -ResultSize 5 -FreeText "Type" -RecordType 1 -Operations Set-Mailbox
No, no additional permissions. Are you perhaps using Hybrid? If the change was made on-premises, it will not show up in the Exchange Online logs.
The other possibility is that it was done over 90 days ago - this is the longest you can search via this method. Using the Unified audit log search above should cover 180 days minimum.
The other possibility is that it was done over 90 days ago - this is the longest you can search via this method. Using the Unified audit log search above should cover 180 days minimum.
VasilMichev, powershell command mentioned in your first response worked. My mistake was i modified the command to display results of last 90 days since we have only M365 Business Premium licenses. Apparently the changes we were looking for were made 5 months ago and no wonder these didn't turn up with search-adminauditlog cmdlet.
Thanks a lot for your help and time 🙂
Regards,
Charlie933
Thanks a lot for your help and time 🙂
Regards,
Charlie933