Track email folder movement across Outlook shared mailboxes

%3CLINGO-SUB%20id%3D%22lingo-sub-270328%22%20slang%3D%22en-US%22%3ETrack%20email%20folder%20movement%20across%20Outlook%20shared%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-270328%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20hope%20I'm%20posting%20in%20the%20right%20group.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20a%20case%20where%20few%20emails%20sent%20to%20mailbox%20A%20appeared%20on%20folders%20at%20mailbox%20B.%20The%20emails%20were%20not%20present%20in%20mailbox%20A.%20Both%20mailboxes%20are%20shared%20mailbox%20and%20available%20on%20the%20user's%20Outlook%20client.%20The%20emails'%20header%20showed%20delivery%20to%20mailbox%20A%20address%20and%20no%20trace%20of%20delivery%20to%20mailbox%20B.%20I%20suspect%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eit%20was%20manually%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Edragged%20the%20email%20to%20mailbox%20B%2C%20but%20the%20user%20swore%20nothing%20was%20done%20and%20insisted%20it's%20system%20glitch.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20track%20the%20movement%20of%20the%20email%20to%20show%20that%20the%20email%20is%20moved%20to%20a%20folder%20in%20another%20mailbox%3F%20Or%20is%20there%20something%20else%20I%20can%20use%20to%20prove%20that%20manual%20handling%20was%20involved%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-270328%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-271363%22%20slang%3D%22en-US%22%3ERe%3A%20Track%20email%20folder%20movement%20across%20Outlook%20shared%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-271363%22%20slang%3D%22en-US%22%3ETracing%20is%20Done%20via%20the%20security%20and%20compliance%20center%20so%20you%20need%20the%20administrator%20for%20this%3CBR%20%2F%3EAdam%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-271324%22%20slang%3D%22en-US%22%3ERe%3A%20Track%20email%20folder%20movement%20across%20Outlook%20shared%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-271324%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20the%20message%20trace%20available%20on%20the%20Client%3F%20Or%20do%20I%20need%20to%20contact%20the%20administrator%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EActually%2C%20I%20also%20checked%20all%20emails%20belong%20to%20the%20same%20conversation%20as%20the%20one%20sent%20to%20the%20%22wrong%22%20mailbox%2C%20everything%20else%20was%20delivered%20to%20the%20correct%20mailbox.%20Hence%2C%20my%20initial%20assumption%20is%20that%20the%20particular%20email%20was%20accidentally%20dragged%20to%20the%20other%20mailbox.%20I%20was%20hoping%20since%20it's%20a%20cross%20mailbox%20movement%2C%20there%20might%20be%20some%20tracing%20or%26nbsp%3B%20marking%20available.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-270532%22%20slang%3D%22en-US%22%3ERe%3A%20Track%20email%20folder%20movement%20across%20Outlook%20shared%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-270532%22%20slang%3D%22en-US%22%3E%3CP%3EIf%20you%20have%20mailbox%20auditing%20enabled%2C%20with%20the%20corresponding%20operations%20included%2C%20reviewing%20the%20audit%20logs%20should%20show%20you%20who%2Fwhen%20did%20this%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBut%20if%20you%20are%20just%20enabling%20it%2C%20it%20will%20not%20include%20details%20for%20past%20actions.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-270331%22%20slang%3D%22en-US%22%3ERe%3A%20Track%20email%20folder%20movement%20across%20Outlook%20shared%20mailboxes%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-270331%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20use%20massage%20trace%20with%20security%20and%20compliance%20center%20to%26nbsp%3B%20see%20who%20sent%20a%20mail%20to%20whom%3C%2FP%3E%3CP%3ETry%20filter%20on%20the%20sender%20for%20that%20mail%20which%20ended%20up%20in%20the%20wrong%20mailbox..%3C%2FP%3E%3CP%3EI%20don't%20think%20it's%20possible%20to%20track%20if%20a%20user%20moves%20a%20mail%20over%20to%20mailbox%20B%20though%2C%20but%20I%20can%20be%20wrong%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%2F%20Adam%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi all,

 

I hope I'm posting in the right group. 

 

I have a case where few emails sent to mailbox A appeared on folders at mailbox B. The emails were not present in mailbox A. Both mailboxes are shared mailbox and available on the user's Outlook client. The emails' header showed delivery to mailbox A address and no trace of delivery to mailbox B. I suspect it was manually dragged the email to mailbox B, but the user swore nothing was done and insisted it's system glitch.

 

Is there a way to track the movement of the email to show that the email is moved to a folder in another mailbox? Or is there something else I can use to prove that manual handling was involved?

 

Thank you.

4 Replies
Highlighted

You can use massage trace with security and compliance center to  see who sent a mail to whom

Try filter on the sender for that mail which ended up in the wrong mailbox..

I don't think it's possible to track if a user moves a mail over to mailbox B though, but I can be wrong

 

/ Adam

Highlighted

If you have mailbox auditing enabled, with the corresponding operations included, reviewing the audit logs should show you who/when did this: https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

 

But if you are just enabling it, it will not include details for past actions.

Highlighted

Is the message trace available on the Client? Or do I need to contact the administrator?

 

Actually, I also checked all emails belong to the same conversation as the one sent to the "wrong" mailbox, everything else was delivered to the correct mailbox. Hence, my initial assumption is that the particular email was accidentally dragged to the other mailbox. I was hoping since it's a cross mailbox movement, there might be some tracing or  marking available.

Highlighted
Tracing is Done via the security and compliance center so you need the administrator for this
Adam