Auditing Mailbox Restore

[Deleted]

Hello Experts,

Kindly let me know how do i export audit logs for admin who has been recovering/restoring deleted mailbox in exchange online?

Thanks 

[#2]

You can able to get auditlog using Search-UnifiedAuditLog. To export the logs use Export-CSV PowerShell query.

[#3]

Santosh

Unifiedauditlog will export audit logs for restored mailbiox.l Are you sure?

[#4]

Using UnifiedAudit Log you can able to get logs for restored mailbox. You need to use Export-CSV PowerShell query to export that to CSV.

[#5]

I exported the audit log but i am unable to find restored mailbox audit

[#6]

Can you let me know how restoration was done? This will help me to spot out what was the cause.

[#7]

Hi Santosh,

Using Admin Portal.

[#8]

It seems you have deleted user from Admin portal. When you delete an user its associated mailbox will be shown as disabled. The audit logs for this action will be available as Operation - Restore user. It will take a while for the logs to get appeared.