How do I view the .modifiedproperties information for Exchange Online Admin Audit Logs?

Question

I'm running the command search-adminauditlogs and I can see the audit log entry that I need. Based on this Microsoft KB article: https://docs.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-administrator-audit-log

This field contains the properties that were modified on the object in the

ObjectModified

field. Also stored in this field, but not visible in the default output, are the old value of the property and the new value that was stored.

How do I get the non-default output to see the old value and new value?

harm_veenstra · Answer

David_Az&nbsp;&nbsp;In Exchange On-Prem it is shown in the array, Name/NewValue/OldValue are there. But in Exchange Online it's empty.. This was the closest I could find which gives you a good idea what the cmdlet was that was started and what the full command was&nbsp;https://github.com/mikiorla/Exchange/blob/master/Get-SimpleAuditLogReport.ps1&nbsp;

Forum Discussion

How do I view the .modifiedproperties information for Exchange Online Admin Audit Logs?