Audit safe senders

[skipster311-175]

I have AdminAuditLogConfig  enabled. I need to find out when a particular user either removed or added a sender to the users "safe senders" list in outlook. How can i accomplish this ? This is for exchange online

[#2]

I'm not sure user's own operations against the safe sender list are being audited. If the action was performed by another user/admin, it should come up when you search the audit log for any Set-MailboxJunkEmailConfiguration entries.

[#3]

If the change was made to the users safe-senders list it would have been made by the user , not an admin.

[#4]

I'm not able to see any audit events generated for owner's changes to the safe sender's list, best open a support case to confirm whether this is expected to generate an audit trail.