Audit shared mailbox email category deleted or renamed

%3CLINGO-SUB%20id%3D%22lingo-sub-219966%22%20slang%3D%22en-US%22%3EAudit%20shared%20mailbox%20email%20category%20deleted%20or%20renamed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-219966%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20have%20recently%20experienced%20some%20troubles%20with%20email%20category%20deleted%20or%20renamed%20by%20users%2C%20we%20are%20looking%20for%20a%20solution%20to%20track%20down%20this%20kind%20of%20changes%20in%20shared%20folders.%20Audit%20log%20seems%20to%20not%20record%20email%20category%20rename%20or%20delete%20operations.%20Any%20suggestion%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20in%20advance%20for%20help%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-219966%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220495%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20shared%20mailbox%20email%20category%20deleted%20or%20renamed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220495%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EYou%20are%20absolutely%20correct.%20Audit%20log%20does%20not%20record%20email%20category%20rename%20or%20other%20operations.%26nbsp%3B%20However%2C%20it%20is%20not%20the%20best%20of%20ideas%20to%20do%20it%20on%20a%20Virtual%20Machine%20as%20you%20will%20face%20many%20issues%20when%20your%20token%20will%20expire.%20%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-220096%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20shared%20mailbox%20email%20category%20deleted%20or%20renamed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-220096%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20simply%20not%20audited%20as%20you%20mentioned%2C%20although%20perhaps%20we%20might%20see%20this%20changed%20in%20the%20future%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FSecurity-Privacy-and-Compliance%2FExchange-Mailbox-Auditing-will-be-enabled-by-default%2Fba-p%2F215171%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FSecurity-Privacy-and-Compliance%2FExchange-Mailbox-Auditing-will-be-enabled-by-default%2Fba-p%2F215171%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

Hello,

 

we have recently experienced some troubles with email category deleted or renamed by users, we are looking for a solution to track down this kind of changes in shared folders. Audit log seems to not record email category rename or delete operations. Any suggestion?

 

Thank you in advance for help

2 Replies
Highlighted

It's simply not audited as you mentioned, although perhaps we might see this changed in the future: https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Exchange-Mailbox-Auditing-wil...

Highlighted

You are absolutely correct. Audit log does not record email category rename or other operations.  However, it is not the best of ideas to do it on a Virtual Machine as you will face many issues when your token will expire.