Mailbox Forwarding, Admin Audit and logging.

[Robert Bollinger]

Hey Guys, 

We have a user whos mailbox was set to forward messages to a different email address (new email address for the user, separate mailbox, separate tenant) and the option for "DeliverToMailboxAndForward" was not set. 

However the mailbox itself where the user wanted the emails forwarded to did not exist, so the messages were permanently lost. 

At this time we would like to find out who enabled forwarding for the user, we've checked admin audit logging and azure logging, and so far no luck. 

Is there a way to tell if the user setup forwarding themselves? i am hoping there is an easy way to determine this, otherwise its a call to microsoft. 

This all happened well within the last 30 days. 

Users mailbox is on exchange online. 

Thanks, 

Robert 

[#2]

@mostafa_ghorbani 

***THIS SITE IS A SCAM*** It passed virus total but it looks like its selling stuff to me. PLEASE DO NOT WASTE MY TIME WITH CRAPPY Sites list this!.

[#3]

I'd suggest you check the audit logs in the EAC as well, as the logs in the SCC often fail to display all events. If you are not finding any entries in the admin log, then it's the user who configured the forwarding.

[#4]

@Vasil Michev 

Thanks for the response as always. I checked the admin audit logs in exchange online both using the command line and via the reports and am not seeing anything. My ticket with Microsoft didn't go far in terms of what happened.

However i did some additional testing and was able to find that a non admin user did have that specific change logged in the admin audit log, so i am not sure. When i test in my work tenant and my test tenant i am seeing those changes logged except for these users. 

The only thing i can think of is that change occurred more than 90 days ago, but honestly i have seen plenty of other things not caught by admin audit logging. So i am going to chalk this up to another office 365 oddity. 

Do you know of another way of checking the EAC Logs? I know of command line and the audit logs from the EAC >> Compliance >> Auditing. I am going to try running the export admin audit log again, just to be sure. 

Robert 

[#5]

Those are the available methods to get the logs. But not every operation will be visible there as some things are considered client-side, and are executed via MAPI/EWS calls instead of PowerShell.