I have AdminAuditLogConfig enabled. I need to find out when a particular user either removed or added a sender to the users "safe senders" list in outlook. How can i accomplish this ? This is for exchange online
I'm not sure user's own operations against the safe sender list are being audited. If the action was performed by another user/admin, it should come up when you search the audit log for any Set-MailboxJunkEmailConfiguration entries.