Echange Online Auditing - Non Owner Mailbox Access Report

[TheWorldInFocusNet]

Hello,

I need to get the Non Owner Mailbox Access report using Powershell for one Month for some large Exchange Online environments.

Unfortunately using "Search-UnifiedAuditLog" as well as performing a "Search-MailboxAuditLog" is extremly slow and even leads to Throttling. Therefor performing the Search for thousands of Mailboxes where the report is required for requires a lot of time.

Is there a way to do this from within PowerShell (as it's part of a reporting "Suite") to be able exporting it to CSV/Excel in an easier way?

Can this be achieved using the Graph API Module for PowerShell?

Thank you for your Help and best regards

[#2 · Accepted solution]

I’m afraid there’s no easier way. Searching the audit log has always been very slow. You may want to see, depending on how much audit data is being generated, to just export all data and filter yourself. I’ve experienced slow downs when the filtering needs to be done server side.

I don’t recall seeing any Graph API actions for this. There is the Office 365 Management APIs which provide access to audit logs, but this is more geared towards subscription based near real time monitoring.

[#3]

@pvanberlo 

Hi, Thank you for your Reply. I'll try to export without filtering thank you for the hint!