Any way to audit who/what deleted an Outlook calendar event via Sentinel?

Copper Contributor

A few users have reported that they are missing calendar events, all of them are recurring events. I have a few examples of meetings that appear in 1 person's calendar but not another's despite them being shown as an attendee (did not respond).

I used delegation and can see the original email message in deleted items, but it doesn't give an insight on the calendar object itself.  Some individuals can also see a few items in their deleted items that show recurring appointments "Exchange Server re-created a meeting that was missing from your calendar."


Wondering how I can track down via KQL of who or what, or from what device (phone (outlook vs mail app, etc..) vs computer) the object was deleted from?

Thanks!

0 Replies