Audit booking changes

Would suggest:

1. Use Microsoft Purview Audit Log with Specific Operations

• Purview Audit logs user and admin activities across Microsoft 365, including Exchange Online resource mailbox operations.
• Search for calendar-related operations such as "Update calendar event", "Delete calendar event", or "Remove calendar event" in the audit log.
• Use PowerShell or the Purview portal to filter by these operations rather than subject lines.

2. Search by Calendar Event ID or Organizer

• If you can obtain the calendar event ID or organizer's email, use these as filters in audit log searches.
• This avoids ambiguity caused by multiple email threads with varying subject prefixes (Re:, FW:).
• You may extract event IDs from user calendars or resource mailbox calendar logs.

3. Use Exchange Online PowerShell Cmdlets for Calendar Auditing

• Cmdlets like Search-UnifiedAuditLog with parameters filtering on calendar or mailbox activities can help.
• Example: Search for CalendarEvent related audit records with date ranges and user/resource mailbox filters.

4. Enable and Use Mailbox Audit Logging for Resource Mailboxes

• Ensure mailbox audit logging is enabled on resource mailboxes.
• This logs actions like calendar event creation, modification, and deletion.
• Use Get-MailboxAuditLog or audit log search to retrieve these actions.

5. Use Microsoft Defender Portal Audit Log Search as a Backup

• Defender portal audit log search is identical to Purview’s but sometimes offers a more user-friendly interface.
• It supports searching user/admin mailbox activities and might provide better filtering options.
• Requires appropriate permissions (Organization Management or Compliance Management role).

6. Consider Third-Party or Custom Tools

• If native tools are insufficient, consider third-party Microsoft 365 auditing tools that specialize in calendar and resource mailbox activities.