Determine date of last email sent to Distribution List

%3CLINGO-SUB%20id%3D%22lingo-sub-835237%22%20slang%3D%22en-US%22%3EDetermine%20date%20of%20last%20email%20sent%20to%20Distribution%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-835237%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20office%20365%20I%20need%20to%20determine%20which%20date%20the%20last%20email%20was%20sent%20to%20a%20distribution%20list.%3CBR%20%2F%3EI%20have%20run%20the%20command%20to%20check%20from%20message%20tracking%20logs%20but%20they%20are%20only%20retained%20for%203%20days%20and%20this%20DL%20does%20not%20list%20in%20the%20output.%3CBR%20%2F%3EI%20will%20be%20checking%20Mail%20filtering%20logs%20but%20I%20am%20not%20sure%20how%20far%20they%20will%20go.%3C%2FP%3E%3CP%3EWhat%20other%20way%20I%20can%20get%20this%20information.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-835237%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-847533%22%20slang%3D%22en-US%22%3ERe%3A%20Determine%20date%20of%20last%20email%20sent%20to%20Distribution%20List%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-847533%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20you%20check%20the%20audit%20log%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20find%20audit%20log%20in%20SCC%3A%20%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fprotect-eu.mimecast.com%2Fs%2F-v2UCrmQRsAYK3h4hj_Y%3Fdomain%3Dnam06.safelinks.protection.outlook.com%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20log%20also%20need%20you%20to%20enable%20audit%20log%2C%20which%20by%20default%20is%20enable.%20Link%3A%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fprotect-eu.mimecast.com%2Fs%2FvYX4Cv8XoUW5m0cAQ4k2%3Fdomain%3Dnam06.safelinks.protection.outlook.com%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20try%20this%20cmdlets%20to%20check%3A%3CSPAN%3E%26nbsp%3Bget-AdminAuditLogConfig%20%7C%20select%20UnifiedAuditLogIngestionEnabled%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CI%3EIf%20it%20is%20not%20enabled%2C%20please%20run%20this%20following%20cmdlets%3A%3C%2FI%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EEnable%20global%20logging%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3ESet-AdminAuditLogConfig%20-UnifiedAuditLogIngestionEnabled%20%24true%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EEnable%20Auditing%20for%20every%20user%3A%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EGet-Mailbox%20-ResultSize%20Unlimited%20-Filter%20%7BRecipientTypeDetails%20-eq%20%22UserMailbox%22%20-or%20RecipientTypeDetails%20-eq%20%22SharedMailbox%22%20-or%20RecipientTypeDetails%20-eq%20%22RoomMailbox%22%20-or%20RecipientTypeDetails%20-eq%20%22DiscoveryMailbox%22%7D%20%7C%20Set-Mailbox%20-AuditEnabled%20%24true%20-AuditLogAgeLimit%20180%20-AuditAdmin%20Update%2C%20MoveToDeletedItems%2C%20SoftDelete%2C%20HardDelete%2C%20SendAs%2C%20SendOnBehalf%2C%20Create%2C%20UpdateFolderPermission%20-AuditDelegate%20Update%2C%20SoftDelete%2C%20HardDelete%2C%20SendAs%2C%20Create%2C%20UpdateFolderPermissions%2C%20MoveToDeletedItems%2C%20SendOnBehalf%20-AuditOwner%20UpdateFolderPermission%2C%20MailboxLogin%2C%20Create%2C%20SoftDelete%2C%20HardDelete%2C%20Update%2C%20MoveToDeletedItems%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

In office 365 I need to determine which date the last email was sent to a distribution list.
I have run the command to check from message tracking logs but they are only retained for 3 days and this DL does not list in the output.
I will be checking Mail filtering logs but I am not sure how far they will go.

What other way I can get this information.

1 Reply
Highlighted

Did you check the audit log?

 

You can find audit log in SCC:  https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

 

This log also need you to enable audit log, which by default is enable. Link: https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

 

You can try this cmdlets to check: get-AdminAuditLogConfig | select UnifiedAuditLogIngestionEnabled 

 

If it is not enabled, please run this following cmdlets:

Enable global logging:

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Enable Auditing for every user:

 

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox" -or RecipientTypeDetails -eq "SharedMailbox" -or RecipientTypeDetails -eq "RoomMailbox" -or RecipientTypeDetails -eq "DiscoveryMailbox"} | Set-Mailbox -AuditEnabled $true -AuditLogAgeLimit 180 -AuditAdmin Update, MoveToDeletedItems, SoftDelete, HardDelete, SendAs, SendOnBehalf, Create, UpdateFolderPermission -AuditDelegate Update, SoftDelete, HardDelete, SendAs, Create, UpdateFolderPermissions, MoveToDeletedItems, SendOnBehalf -AuditOwner UpdateFolderPermission, MailboxLogin, Create, SoftDelete, HardDelete, Update, MoveToDeletedItems