SOLVED

auditing

%3CLINGO-SUB%20id%3D%22lingo-sub-218906%22%20slang%3D%22en-US%22%3Eauditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218906%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20experts%3C%2FP%3E%3CP%3EWe%20are%20using%20exchange%20hybrid%20environment%2C%20user%20is%20exchange%20online%20user%2C%20DL%20is%20onpremises%20DL%3C%2FP%3E%3CP%3Ei%20want%20to%20know%20on%20which%20date%20a%20user%20is%20added%20to%20a%20DL.%20lets%20say%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22mailto%3Auser1%40mydomain.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Euser1%40mydomain.com%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eis%20added%20to%20a%20dl%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22mailto%3Amydl%40mydomain.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Emydl%40mydomain.com%3C%2FA%3E.%20Auditing%20is%20enabled%20for%20the%20mailbox.%20please%20help%20me%20to%20trace%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-218906%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMicrosoft%20Teams%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOn-Premises%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-218959%22%20slang%3D%22en-US%22%3ERe%3A%20auditing%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-218959%22%20slang%3D%22en-US%22%3Emailbox%20auditing%20isn't%20going%20to%20show%20that%20as%20it's%20actions%20occurring%20in%20the%20mailbox.%20It's%20going%20to%20be%20related%20to%20Active%20directory%20auditing%20on%20prem%20that%20would%20have%20to%20be%20setup%20to%20see%20this%20change.%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor

Hi experts

We are using exchange hybrid environment, user is exchange online user, DL is onpremises DL

i want to know on which date a user is added to a DL. lets say user1@mydomain.com is added to a dl mydl@mydomain.com. Auditing is enabled for the mailbox. please help me to trace

1 Reply
Highlighted
Best Response confirmed by Rising Flight (Frequent Contributor)
Solution
mailbox auditing isn't going to show that as it's actions occurring in the mailbox. It's going to be related to Active directory auditing on prem that would have to be setup to see this change.