Audit log search no longer works for shared mailboxes

[SuleimanDaCosta]

It was working find then stopped last month some time - now gives no results. After backwards and forwards with support see the response we received from them below. 

"As earlier advised the changes are made recently by the programming team after which non license mailbox user will be able to see O365 Admin logs from power shell and EAC and will not be able to see Unified audit logs from SCC and power shell."

This does not seem plausible to me but I would like to get some feedback from the rest of you.

[#2]

@SuleimanDaCosta 

This is not a Valid Justification and i have tested this on my Tenant and it is working for a Non-Licensed Global Admin & Compliance Admin.

Thanks

Ankit Shukla

[#3]

@ankit shukla 

Thank you. Are you able to test this against a shared mailbox?

[#4]

@SuleimanDaCosta 

Yep, i will test in few hours, travelling right now and would confirm asap.

Cheers !

Ankit Shukla

[#5]

I'm a bit unclear on that statement. Are they saying, that audit events generated for (unlicensed) shared mailboxes no longer flow to the Unified log, and you have to use the Exchange tools to work with them? Which I guess is also what you are complaining about in this thread? If so - I just run a test on my tenant, and I can see events for shared mailboxes just fine in the Unified log.

Or are they saying that in order to see Exchange mailbox audit events in the Unified log, you need to run the search with an licensed account?

[#6]

@ankit shukla  @SuleimanDaCosta  

I'm able to 

1. Search for Unified Audit logs of an Unlicensed Mailbox in Security & Compliance Center.

2. Search for Logs using an Unlicensed Global Admin.

This tells me whatever you have been told is not justified. If Microsoft did really says something it is backed up by a Product Update number which also reflects on the Message Center under Office 365 Admin center. Ask for that and please do update here once received.

Clearly looks like some miscommunication here from somewhere.

Cheers !!

Ankit Shukla

[#7]

@Vasil Michev They are saying that even though we have logging turned on for all types of mailboxes, we cannot get results for shared mailboxes because they are unlicensed. I want to be able to tell who moved, deleted, etc any emails in a shared mailbox which we cannot do at the moment.

@ankit shukla  I completely agree with you and I could not find any documentation to back up what they told us. Thank you for your help.

[#8]

Well considering both me and ankit seem to have no trouble fetching audit records for shared mailbox in the Unified log, I call bull**bleep**. Either ask them to point you to official statement on the subject, or get them to escalate it as an obvious issue in your tenant.

[#9]

@SuleimanDaCosta I know this is an old thread but i'm having the same issue.  i have full auditing but if i put in the shared mailbox address in Audit Log Search GUI in O365 Admin center, i get no results for anything and I need to see who deleted an item.

I found this thread too which makes me think this is NOT in place - but others have said they can do this.  Can anyone having success with this provide how they are doing this? I just need to find out who deleted a folder on a shared mailbox.

[#10]

Could you please tell me how you could search for unified audit logs of an unlicensed mailbox in Security & Compliance center?? @ankit shukla 

[#11]

@ShikoBiko Sorry was sick , so couldn't reply in time.

Protection.office.com < Search  < Audit Logs 
Then Select Stat and end date (time if you are sure when and what may have happened ) 

In the user section field, Enter PrimarySMTP or UPN of the Shared mailbox you are looking to audit.

Run/Search

Bingo !!

Cheers :)