Forum Discussion
Mailbox Forwarding, Admin Audit and logging.
Thanks for the response as always. I checked the admin audit logs in exchange online both using the command line and via the reports and am not seeing anything. My ticket with Microsoft didn't go far in terms of what happened.
However i did some additional testing and was able to find that a non admin user did have that specific change logged in the admin audit log, so i am not sure. When i test in my work tenant and my test tenant i am seeing those changes logged except for these users.
The only thing i can think of is that change occurred more than 90 days ago, but honestly i have seen plenty of other things not caught by admin audit logging. So i am going to chalk this up to another office 365 oddity.
Do you know of another way of checking the EAC Logs? I know of command line and the audit logs from the EAC >> Compliance >> Auditing. I am going to try running the export admin audit log again, just to be sure.
Robert
Those are the available methods to get the logs. But not every operation will be visible there as some things are considered client-side, and are executed via MAPI/EWS calls instead of PowerShell.