Forum Discussion
Audit log search no longer works for shared mailboxes
I'm able to
1. Search for Unified Audit logs of an Unlicensed Mailbox in Security & Compliance Center.
2. Search for Logs using an Unlicensed Global Admin.
This tells me whatever you have been told is not justified. If Microsoft did really says something it is backed up by a Product Update number which also reflects on the Message Center under Office 365 Admin center. Ask for that and please do update here once received.
Clearly looks like some miscommunication here from somewhere.
Cheers !!
Ankit Shukla
VasilMichev They are saying that even though we have logging turned on for all types of mailboxes, we cannot get results for shared mailboxes because they are unlicensed. I want to be able to tell who moved, deleted, etc any emails in a shared mailbox which we cannot do at the moment.
ankit shukla I completely agree with you and I could not find any documentation to back up what they told us. Thank you for your help.
SuleimanDaCosta I know this is an old thread but i'm having the same issue. i have full auditing but if i put in the shared mailbox address in Audit Log Search GUI in O365 Admin center, i get no results for anything and I need to see who deleted an item.
I foundhttps://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/18824797-shared-mailbox-audit-option-to-see-all-activity-in too which makes me think this is NOT in place - but others have said they can do this. Can anyone having success with this provide how they are doing this? I just need to find out who deleted a folder on a shared mailbox.
Well considering both me and ankit seem to have no trouble fetching audit records for shared mailbox in the Unified log, I call bull**bleep**. Either ask them to point you to official statement on the subject, or get them to escalate it as an obvious issue in your tenant.
