A few users have reported that they are missing calendar events, all of them are recurring events. I have a few examples of meetings that appear in 1 person's calendar but not another's despite them being shown as an attendee (did not respond).
I used delegation and can see the original email message in deleted items, but it doesn't give an insight on the calendar object itself. Some individuals can also see a few items in their deleted items that show recurring appointments "Exchange Server re-created a meeting that was missing from your calendar."
Wondering how I can track down via KQL of who or what, or from what device (phone (outlook vs mail app, etc..) vs computer) the object was deleted from?
Thanks!
