Filter by Shared Mailbox, not user.

[Kris Klutke]

Hi All,

We had an instance in a Shared Mailbox where somebody (unknown) deleted a large amount of emails. I'm trying to find a way to identify who the user was. 

So far I can filter down to:
Activities: "MoveToDeletedItems, HardDelete, SoftDelete" 

App: "Microsoft Exchange Online"

This is where I get stuck, I'm now seeing this for all mailboxes and cannot find a way to specify the Shared Mailbox in question. 

Can someone please filter on mailbox and not user? 

[#2]

Mailbox auditing is not enabled by default for shared mailboxes, so you might simply not have any of those events. In any case, instead of using the CAS UI, run the Search-MailboxAuditLog cmdlet: https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-mailb...