Audit log search no longer works for shared mailboxes

Question

It was working find then stopped last month some time - now gives no results. After backwards and forwards with support see the response we received from them below.

"As earlier advised the changes are made recently by the programming team after which non license mailbox user will be able to see O365 Admin logs from power shell and EAC and will not be able to see Unified audit logs from SCC and power shell."

This does not seem plausible to me but I would like to get some feedback from the rest of you.

vasilmichev · Answer

Well considering both me and ankit seem to have no trouble fetching audit records for shared mailbox in the Unified log, I call bull**bleep**. Either ask them to point you to official statement on the subject, or get them to escalate it as an obvious issue in your tenant.

ankit shukla · Answer

SuleimanDaCosta&nbsp;&nbsp;This is not a Valid Justification and i have tested this on my Tenant and it is working for a Non-Licensed Global Admin &amp; Compliance Admin.&nbsp;ThanksAnkit Shukla&nbsp;

suleimandacosta · Answer

ankit shukla&nbsp;&nbsp;Thank you. Are you able to test this against a shared mailbox?

ankit shukla · Answer

SuleimanDaCosta&nbsp;&nbsp;Yep, i will test in few hours, travelling right now and would confirm asap.&nbsp;Cheers !Ankit Shukla&nbsp;

vasilmichev · Answer

I'm a bit unclear on that statement. Are they saying, that audit events generated for (unlicensed) shared mailboxes no longer flow to the Unified log, and you have to use the Exchange tools to work with them? Which I guess is also what you are complaining about in this thread? If so - I just run a test on my tenant, and I can see events for shared mailboxes just fine in the Unified log.
&nbsp;
Or are they saying that in order to see Exchange mailbox audit events in the Unified log, you need to run the search with an licensed account?

Forum Discussion

Audit log search no longer works for shared mailboxes

10 Replies

Resources