IMAP and POP verbose logging

%3CLINGO-SUB%20id%3D%22lingo-sub-142159%22%20slang%3D%22en-US%22%3EIMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-142159%22%20slang%3D%22en-US%22%3E%3CP%3EAre%20there%20commands%20in%20Exchange%20management%20powershell%20to%20list%20IMAP%20and%20POP%20activities%26nbsp%3B%20-%20for%20example%20if%20emails%20were%20downloaded%2C%20synchronized%20from%20a%20user%20account%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-142159%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-142657%22%20slang%3D%22en-US%22%3ERe%3A%20IMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-142657%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20outlining%20the%20options%2C%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F65976%22%20target%3D%22_blank%22%3E%40Dominik%20Hoefling%3C%2FA%3E!%20Other%20than%20enabling%20verbose%20logging%20in%20Outlook%20(which%20slows%20Outlook)%2C%20I%20have%20done%20the%20other%202%2C%20but%20have%20not%20gotten%20the%20information%20on%20IMAP%20detailed%20events%20logging.%20I%20saw%20that%20the%20account%20connected%20via%20IMAP%2C%20but%20I%20did%20not%20see%20if%20the%20Inbox%20folder%20was%20downloaded%2C%20or%20emails%20were%20synced.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20again!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-142233%22%20slang%3D%22en-US%22%3ERe%3A%20IMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-142233%22%20slang%3D%22en-US%22%3E%3CP%3EAFAIK%20no.%3C%2FP%3E%0A%3CP%3EThere%20are%203%20things%20I%20would%20consider%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20Determining%20how%20users%20are%20accessing%20their%20mailboxes%20in%20Office%20365%3A%20%3CA%20href%3D%22https%3A%2F%2Fwww.cogmotive.com%2Fblog%2Foffice-365-tips%2Fdetermining-how-users-are-accessing-their-mailboxes-in-office-365%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.cogmotive.com%2Fblog%2Foffice-365-tips%2Fdetermining-how-users-are-accessing-their-mailboxes-in-office-365%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E2.%20You%20could%20enable%20Outlook%20logging%20and%20collect%20the%20log%20files%20i.e.%20on%20a%20file%20share.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E3.%20Enable%20mailbox%20audit%20logging%20for%20those%20mailboxes%20and%20check%20if%20the%20log%20contains%20some%20information%20about%20IMAP%20and%20POP%20access%20and%20maybe%20activities.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-998764%22%20slang%3D%22en-US%22%3ERe%3A%20IMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-998764%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F6110%22%20target%3D%22_blank%22%3E%40Emy%20Loanzon%3C%2FA%3E%26nbsp%3BJust%20checking%20if%20you%20ever%20found%20a%20way%20to%20determine%20if%26nbsp%3B%3CSPAN%3EInbox%20folder%20was%20downloaded%2C%20or%20emails%20were%20synced%3F%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EI%20have%20same%20challenge%20and%20cant%20find%20an%20options.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1015152%22%20slang%3D%22en-US%22%3ERe%3A%20IMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1015152%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F393307%22%20target%3D%22_blank%22%3E%40lfkentwell%3C%2FA%3E%26nbsp%3BSorry%20for%20the%20late%20response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENo%2C%20I%20was%20not%20able%20to%20figure%20out%20the%20POP%2FIMAP%20activities%20in%20a%20mailbox.%20When%20I%20was%20investigating%20this%2C%26nbsp%3B%20logging%20POP%2FIMAP%20activities%20was%20available%20for%20on%20premise%20Exchange%20servers%2C%20not%20with%20Exchange%20Online.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1015725%22%20slang%3D%22en-US%22%3ERe%3A%20IMAP%20and%20POP%20verbose%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1015725%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F6110%22%20target%3D%22_blank%22%3E%40Emy%20Loanzon%3C%2FA%3E%26nbsp%3Bthis%20was%20pretty%20much%20my%20conclusion%20also.%26nbsp%3B%20Later%20confirmed%20by%20Microsoft%20premier%20support.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Are there commands in Exchange management powershell to list IMAP and POP activities  - for example if emails were downloaded, synchronized from a user account?

 

Thanks.

5 Replies
Highlighted

AFAIK no.

There are 3 things I would consider:

 

1. Determining how users are accessing their mailboxes in Office 365: https://www.cogmotive.com/blog/office-365-tips/determining-how-users-are-accessing-their-mailboxes-i...

 

2. You could enable Outlook logging and collect the log files i.e. on a file share.

 

3. Enable mailbox audit logging for those mailboxes and check if the log contains some information about IMAP and POP access and maybe activities.

Highlighted

Thanks for outlining the options, @Dominik Hoefling! Other than enabling verbose logging in Outlook (which slows Outlook), I have done the other 2, but have not gotten the information on IMAP detailed events logging. I saw that the account connected via IMAP, but I did not see if the Inbox folder was downloaded, or emails were synced.

 

Thanks again!

Highlighted

@Emy Loanzon Just checking if you ever found a way to determine if Inbox folder was downloaded, or emails were synced?

 

I have same challenge and cant find an options.

Highlighted

@lfkentwell Sorry for the late response.

 

No, I was not able to figure out the POP/IMAP activities in a mailbox. When I was investigating this,  logging POP/IMAP activities was available for on premise Exchange servers, not with Exchange Online.

 

 

 

Highlighted

@Emy Loanzon this was pretty much my conclusion also.  Later confirmed by Microsoft premier support.