Forum Discussion
Auditing an O365 shared mailbox
I have turned on auditing on an Office 365 shared mailbox, but when I do a search at the audit logs I get zero results.
I've expanded from the standard auditing and added the parameters "harddelete...
From my experience, The auditing configurations are not affected immediately. It will take some time to start monitoring the configured audit actions.
Do you know, or is there documentation on how fast these turn on?
I did these commands days ago and the incident that i wanted to catch in a log happened today.
- Hi Jacob,
It can take a while ..
https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c#PickTab=BYB
Thanks
Rob - Surely it will not take a day!
I have seen a maximum of an hour delay, In some cases, I could see that the activities are tracked after few minutes.
How did you confirm that your settings didn't work? Did you try deleting any emails and checked the audit log?Sorry Jacob Airov, I mean the actual searching cmdlets.
