Audit safe senders
I have AdminAuditLogConfig enabled. I need to find out when a particular user either removed or added a sender to the users "safe senders" list in outlook. How can i accomplish this ? This is for exchange online
Forum Discussion
- I'm not sure user's own operations against the safe sender list are being audited. If the action was performed by another user/admin, it should come up when you search the audit log for any Set-MailboxJunkEmailConfiguration entries.
- If the change was made to the users safe-senders list it would have been made by the user , not an admin.
- I'm not able to see any audit events generated for owner's changes to the safe sender's list, best open a support case to confirm whether this is expected to generate an audit trail.
