Search-MailboxAuditLog export email operations

[Andrew Huddleston]

Hello, is it possible to track through audit logs or other, the export|download of a mailbox to pst or some format for offline reading?

Eg does turning on OWA offline mode, or export pst using Powershell trigger an audit event?

I think Powershell is logged.

I guess I could perform this on my own mailbox to test, but any solid advice or knowledge would help here.

[#2 · Accepted solution]

Export via PST is an admin-level functionality, so it's audited by default. Using the offline mode in clients is not audited afaik.