Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Audit events on a mailbox

Copper Contributor

Looking for audit data for an adminstrator/enduser driven Set-Mailbox -ForwardingSmtpAddress /ForwardingAddress cmd actions..

 

Is this something that can be tracked without mbx auditing turned on?

Dont seem to find this info the unified logs. any ideas

2 Replies

If the user has set the forwarding himself, it will not be visible in the audit logs (it doesnt use the cmdlet). If someone with admin access has configured the forwarding, it should be visible, even with mailbox-level auditing disabled.

 

There is not a consistent way to capture this activity through audit log search due to audit log search only captures the mail forwarding configuration changes when it changed by the admin.

 

For a consistent view, you need to check the mailbox properties to find whether forwarding is set. Run the below script to get all the mailboxes with forwarding enabled.

 

 

Get-mailbox | select DisplayName,ForwardingAddress | where {$_.ForwardingAddress -ne $Null}