SharedMailbox converted to Distribution List logs

[badsector]

I have several users that claim a Shared Mailbox was converted to a Distribution List. I can't find any logs that confirm this. We are using purely Exchange Online. Where should I look?

[#2]

There is no such "conversion" process in Exchange, get them to clarify exactly what they did.

[#3]

That's what I thought, but I wanted to know if there's a way to find audit logs for a (Dynamic)Distribution Group. I don't find such option in the Compliance portal. And do you by chance have idea why the command "New-Mailbox" doesn't have properties "-InactiveMailbox" and "-Shared" in one property set?

[#4]

The compliance portal UI does not expose all operations you can search against, use PowerShell and the Search-UnifiedAuditLog cmdlet instead, where you can search for specific cmdlet. For example:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-35) -EndDate (Get-Date) -Operations New-Mailbox

The New-Mailbox cmdlet does have -Shared parameter, if you are not seeing it someone has likely made changes to the default roles. The -InactiveMailbox parameter is only available on the Get- cmdlet, as you cannot directly create an inactive mailbox.

[#5]

"New-Mailbox -InactiveMailbox" actually recovers a soft deleted mailbox. It just can't be used in conjunction with "Shared" parameter as these two are in different parameter sets. And I was wondering why is that. Of course one can first use "New-Mailbox -InactiveMailbox" to recover the mailbox as UserMailbox and then convert it to Shared. But why the extra steps instead of simply giving the ability to use "New-Mailbox -Shared -InactiveMailbox"?