none
Audit log search RRS feed

  • Question

  • Hello,

    i have a problem with 1 user searching in audit logs (https://protection.office.com) Exchange mailbox activities.

    I get a blank result.

    In exchange:

    get-mailbox user | fl *audit*

    AuditEnabled     : True
    AuditLogAgeLimit : 90.00:00:00
    AuditAdmin       : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
    AuditDelegate    : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
    AuditOwner       : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
    DefaultAuditSet  : {Admin, Delegate, Owner}

    mailbox auditing on by default is enabled for the organization

    Get-OrganizationConfig | Format-List AuditDisabled
    AuditDisabled : False



    • Edited by TOMMY 11 Wednesday, September 11, 2019 10:34 AM
    Wednesday, September 11, 2019 10:26 AM

Answers

All replies

  • The audit log show only who has the license E5 , who has E3 does not show auditing. Maybe there is an option to enable E3 license auditing ?

    for more accurate filtering exchange mailbox actitivies other filters run on E3


    • Edited by TOMMY 11 Thursday, September 12, 2019 5:30 AM
    Wednesday, September 11, 2019 6:50 PM
  • Hi,

    The description about the license in the official document

    Search the audit log in the Security & Compliance Center

    • Office 365 E3: Audit records are retained for 90 days. That means you can search the audit log for activities that were performed within the last 90 days.
    • Office 365 E5: Audit records are also retained for 90 days. Retaining audit records for one year may eventually be available for E5 users and users with an E3 license and an Office 365 Advanced Compliance add-on license.

    For more detailed information about: Manage mailbox auditing

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, September 12, 2019 6:18 AM
  • Resolved :

    Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Select PrimarySmtpAddress | ForEach {Set-Mailbox -Identity $_.PrimarySmtpAddress -AuditEnabled $true}

    This comannd fix problems all mailbox auditing.

    For more detailed information about: Enable or disable mailbox audit logging for a mailbox

    Thursday, September 12, 2019 7:11 PM
  • Hi,

    That's great! Thanks for your sharing, you can mark your reply as answer, this will make answer searching in the forum easier and be beneficial to other community members as well.

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Friday, September 13, 2019 1:10 AM