Auditing Mailbox Restore

%3CLINGO-SUB%20id%3D%22lingo-sub-14211%22%20slang%3D%22en-US%22%3EAuditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14211%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Experts%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKindly%20let%20me%20know%20how%20do%20i%20export%20audit%20logs%20for%20admin%20who%20has%20been%20recovering%2Frestoring%20deleted%20mailbox%20in%20exchange%20online%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-14211%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14291%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14291%22%20slang%3D%22en-US%22%3EIt%20seems%20you%20have%20deleted%20user%20from%20Admin%20portal.%20When%20you%20delete%20an%20user%20its%20associated%20mailbox%20will%20be%20shown%20as%20disabled.%20The%20audit%20logs%20for%20this%20action%20will%20be%20available%20as%20Operation%20-%20Restore%20user.%20It%20will%20take%20a%20while%20for%20the%20logs%20to%20get%20appeared.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14252%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14252%22%20slang%3D%22en-US%22%3EHi%20Santosh%2C%3CBR%20%2F%3E%3CBR%20%2F%3EUsing%20Admin%20Portal.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14250%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14250%22%20slang%3D%22en-US%22%3ECan%20you%20let%20me%20know%20how%20restoration%20was%20done%3F%20This%20will%20help%20me%20to%20spot%20out%20what%20was%20the%20cause.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14235%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14235%22%20slang%3D%22en-US%22%3EI%20exported%20the%20audit%20log%20but%20i%20am%20unable%20to%20find%20restored%20mailbox%20audit%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14232%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14232%22%20slang%3D%22en-US%22%3EUsing%20UnifiedAudit%20Log%20you%20can%20able%20to%20get%20logs%20for%20restored%20mailbox.%20You%20need%20to%20use%20Export-CSV%20PowerShell%20query%20to%20export%20that%20to%20CSV.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14230%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14230%22%20slang%3D%22en-US%22%3ESantosh%3CBR%20%2F%3E%3CBR%20%2F%3EUnifiedauditlog%20will%20export%20audit%20logs%20for%20restored%20mailbiox.l%20Are%20you%20sure%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-14229%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20Mailbox%20Restore%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-14229%22%20slang%3D%22en-US%22%3EYou%20can%20able%20to%20get%20auditlog%20using%20Search-UnifiedAuditLog.%20To%20export%20the%20logs%20use%20Export-CSV%20PowerShell%20query.%3C%2FLINGO-BODY%3E
Highlighted
Deleted
Not applicable

Hello Experts,

 

Kindly let me know how do i export audit logs for admin who has been recovering/restoring deleted mailbox in exchange online?

 

Thanks 

7 Replies
Highlighted
You can able to get auditlog using Search-UnifiedAuditLog. To export the logs use Export-CSV PowerShell query.
Highlighted
Santosh

Unifiedauditlog will export audit logs for restored mailbiox.l Are you sure?
Highlighted
Using UnifiedAudit Log you can able to get logs for restored mailbox. You need to use Export-CSV PowerShell query to export that to CSV.
Highlighted
I exported the audit log but i am unable to find restored mailbox audit
Highlighted
Can you let me know how restoration was done? This will help me to spot out what was the cause.
Highlighted
Hi Santosh,

Using Admin Portal.
Highlighted
It seems you have deleted user from Admin portal. When you delete an user its associated mailbox will be shown as disabled. The audit logs for this action will be available as Operation - Restore user. It will take a while for the logs to get appeared.