Forum Discussion

badsector's avatar
badsector
Brass Contributor
Jun 22, 2023

SharedMailbox converted to Distribution List logs

I have several users that claim a Shared Mailbox was converted to a Distribution List. I can't find any logs that confirm this. We are using purely Exchange Online. Where should I look?

  • There is no such "conversion" process in Exchange, get them to clarify exactly what they did.
    • badsector's avatar
      badsector
      Brass Contributor
      That's what I thought, but I wanted to know if there's a way to find audit logs for a (Dynamic)Distribution Group. I don't find such option in the Compliance portal. And do you by chance have idea why the command "New-Mailbox" doesn't have properties "-InactiveMailbox" and "-Shared" in one property set?
      • VasilMichev's avatar
        VasilMichev
        MVP
        The compliance portal UI does not expose all operations you can search against, use PowerShell and the Search-UnifiedAuditLog cmdlet instead, where you can search for specific cmdlet. For example:

        Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-35) -EndDate (Get-Date) -Operations New-Mailbox

        The New-Mailbox cmdlet does have -Shared parameter, if you are not seeing it someone has likely made changes to the default roles. The -InactiveMailbox parameter is only available on the Get- cmdlet, as you cannot directly create an inactive mailbox.

Resources