Forum Discussion

SuleimanDaCosta's avatar
SuleimanDaCosta
Copper Contributor
Jul 24, 2019

Audit log search no longer works for shared mailboxes

It was working find then stopped last month some time - now gives no results. After backwards and forwards with support see the response we received from them below.    "As earlier advised the chan...
Auditing
exchange
office 365
security
Shared mailbox
ankit shukla's avatar
ankit shukla
Iron Contributor
Jul 24, 2019

SuleimanDaCosta 

 

Yep, i will test in few hours, travelling right now and would confirm asap.

 

Cheers !

Ankit Shukla

 

  • ankit shukla's avatar
    ankit shukla
    Iron Contributor
    Jul 24, 2019

    ankit shukla  SuleimanDaCosta  

    I'm able to 

     

    1. Search for Unified Audit logs of an Unlicensed Mailbox in Security & Compliance Center.

    2. Search for Logs using an Unlicensed Global Admin.

     

    This tells me whatever you have been told is not justified. If Microsoft did really says something it is backed up by a Product Update number which also reflects on the Message Center under Office 365 Admin center. Ask for that and please do update here once received.

     

    Clearly looks like some miscommunication here from somewhere.

     

    Cheers !!

    Ankit Shukla

     

    • ShikoBiko's avatar
      ShikoBiko
      Copper Contributor
      Mar 16, 2020

      Could you please tell me how you could search for unified audit logs of an unlicensed mailbox in Security & Compliance center?? ankit shukla 

      • ankit shukla's avatar
        ankit shukla
        Iron Contributor
        Mar 16, 2020

        ShikoBiko Sorry was sick , so couldn't reply in time.

         

        Protection.office.com < Search  < Audit Logs 
        Then Select Stat and end date (time if you are sure when and what may have happened ) 

        In the user section field, Enter PrimarySMTP or UPN of the Shared mailbox you are looking to audit.

        Run/Search

         

        Bingo !!

         

        Cheers 🙂 

         

    • SuleimanDaCosta's avatar
      SuleimanDaCosta
      Copper Contributor
      Jul 25, 2019

      VasilMichev They are saying that even though we have logging turned on for all types of mailboxes, we cannot get results for shared mailboxes because they are unlicensed. I want to be able to tell who moved, deleted, etc any emails in a shared mailbox which we cannot do at the moment.

       

      ankit shukla  I completely agree with you and I could not find any documentation to back up what they told us. Thank you for your help.

      • ajrechk's avatar
        ajrechk
        Copper Contributor
        Feb 13, 2020

        SuleimanDaCosta I know this is an old thread but i'm having the same issue.  i have full auditing but if i put in the shared mailbox address in Audit Log Search GUI in O365 Admin center, i get no results for anything and I need to see who deleted an item.

         

        I foundhttps://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/18824797-shared-mailbox-audit-option-to-see-all-activity-in too which makes me think this is NOT in place - but others have said they can do this.  Can anyone having success with this provide how they are doing this? I just need to find out who deleted a folder on a shared mailbox.