Audit Logs

2 Topics

Issue with search mailbox audit log on Exchange Online
Hi Exchange experts I have an issue with searching the audit logs with the mailboxes on Exchange Online. I have a mailbox on Exchange Online.The properties of that mailbox are as follows AuditEnabled: True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Update, MoveToDeletedItems, SoftDelete, HardDelete...} AuditDelegate : {Update, MoveToDeletedItems, SoftDelete, HardDelete...} AuditOwner : {Update, MoveToDeletedItems, SoftDelete, HardDelete...} DefaultAuditSet : {Admin, Delegate, Owner} I have conduted the changes on this maibox such as: changed the Send as permission, changed the Send on behafl, delegated another user on this mailbox. A few days later I used the Audit feature fromsecurity.microsoft.com portal to search the log for above activities with this maibox but I could not find any entries log that I did a few days ago. The options that I made when searching for mailbox logs Date time range:selected the time period in which I made the change Activities - friendly names: selected all activities on Exchange maibox activities Activities - operation name: blank Record types: blank Search name: blank User: Selecteduser that has a mailbox I have changed. Also, when I executed the syntax with Exchange PowerShell it doesn't show the change history that I want to see. Search-MailboxAuditLog -Identity po.panda@mydomain -LogonTypes Admin, Delegate -StartDate 7/15/24 -EndDate 7/19/24 -ResultSize 5000
Solved
Parker0105
Jul 24, 2024 Place Exchange
802Views
0likes
8Comments
Repost: Important Announcement: Deprecation of Search-AdminAuditLog and New-AdminAuditLogSearch cmdl
In case you get your Exchange blog posts from the Exchange Team's EHLO blog, you may have missed this doozy: Important Announcement: Deprecation of Search-AdminAuditLog and New-AdminAuditLogSearch cmdlets - Microsoft Community Hub It has been posted in the Security, Compliance and Identity blog instead.
JeremyTBradshaw
Feb 02, 2024 Place Exchange
267Views
0likes
0Comments