This is in an Office 365 tenant that I didn't manage from the start, so it's unclear what has been turned on and of regarding auditing.
The case: A user's calendar items disappear after several weeks (like after 47 days). He doesn't delete them, so we are looking for something that is doing it (an app, a setting, etc.). I'm not familiar with Office 365 / Exchange doing a calendar cleanup or something by default, so it has to be something he installed?
So, to start my investigation I thought about looking in the audit logs. But I don't see any log entries for this user (and also not what I expect with other users).
The Powershell results below are the same for every user:
Get-Mailbox -Identity email@example.com | Format-List Audit* gives me this result: