How do I view the .modifiedproperties information for Exchange Online Admin Audit Logs?

Senior Member

I'm running the command search-adminauditlogs and I can see the audit log entry that I need. Based on this Microsoft KB article:

This field contains the properties that were modified on the object in the


field. Also stored in this field, but not visible in the default output, are the old value of the property and the new value that was stored.


How do I get the non-default output to see the old value and new value?

1 Reply



In Exchange On-Prem it is shown in the array, Name/NewValue/OldValue are there. But in Exchange Online it's empty.. This was the closest I could find which gives you a good idea what the cmdlet was that was started and what the full command was