Shared Mailbox Audit Logs

[NThoman]

The other day we needed to check who was working in a shared email mailbox. However when we went to the compliance center Audit Log search nothing returned. It returns info for all other users... just not the shared mailboxes. Do shared mailboxes need to be licensed for them to show up?

I reviewed this article and confirmed all our accounts are enabled for auditing.....

https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwid...

[#2]

Use good old Exchange audit log (or the Search-MailboxAuditLog cmdlet) - some events don't flow to the unified audit log by design.

[#3]

If I license them... will they?

[#4]

I suppose, thought that kind of defeats the purpose of a shared mailbox: https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwid...