Forum Discussion
badsector
Jun 22, 2023Brass Contributor
SharedMailbox converted to Distribution List logs
I have several users that claim a Shared Mailbox was converted to a Distribution List. I can't find any logs that confirm this. We are using purely Exchange Online. Where should I look?
- There is no such "conversion" process in Exchange, get them to clarify exactly what they did.
- badsectorBrass ContributorThat's what I thought, but I wanted to know if there's a way to find audit logs for a (Dynamic)Distribution Group. I don't find such option in the Compliance portal. And do you by chance have idea why the command "New-Mailbox" doesn't have properties "-InactiveMailbox" and "-Shared" in one property set?
- The compliance portal UI does not expose all operations you can search against, use PowerShell and the Search-UnifiedAuditLog cmdlet instead, where you can search for specific cmdlet. For example:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-35) -EndDate (Get-Date) -Operations New-Mailbox
The New-Mailbox cmdlet does have -Shared parameter, if you are not seeing it someone has likely made changes to the default roles. The -InactiveMailbox parameter is only available on the Get- cmdlet, as you cannot directly create an inactive mailbox.