Tuesday, 8 December 2015

Office 365 Mailbox Audit Logs for Owner

Subject seems new, Right..

No, No.... I didn't delete this Email, Show me Audit logs, Well.. Now we can.. :-)

Office365 now supports Mailbox audit logs for Owner as well, How to do so, Just follow below steps:

  1. Connect to Exchange Online Powershell
  2. Run below commands:

Search-MailboxAuditLog User@domain.com -ShowDetails -LogonTypes Owner | ft Operation,Client*,LastAccessed

There are lot more can be retrieved as you can specify StartDate EndDate Etc.

Operation parameter returns below values, You can check the ClientIP to find from where user logged in.

  • Create
  • FolderBind
  • HardDelete
  • MailboxLogin This value is available only in Exchange 2016, and only when the LogonTypes parameter value Owner is also specified.
  • MessageBind
  • Move
  • MoveToDeletedItems
  • SendAs
  • SendOnBehalf
  • SoftDelete
  • Update
Feel free to comment for any questions.

No comments:

Post a Comment

Blog Archive