none
Outlook 2016 Audit Trail

    Question

  • I work with a team of 15 individuals and for our email client we use Outlook 2016, we just upgraded each PC to Windows 10 this week if that makes a difference. My problem is that we have 1 person in charge of distributing emails as they come in and these emails are distributed in a specific rotation to be fair to each employee, however, with this shared access anyone is able to go in and move emails to whichever inbox they please with no way of tracking who moved which email to which folder and when they did it. 

    Is there any way to show an audit trail regarding who moved an email? There was a thread made about this earlier this month yet I see no official answer.  Original thread: http://answers.microsoft.com/en-us/outlook_com/forum/osecurity-oother/how-can-we-set-up-audit-trail-for-shared-mailbox/2581240a-f2ed-4770-b189-ca011f13332c?auth=1

    They asked if something could be displayed like this: 'Email moved from ABC folder to XYZ folder by user: Jsmith'

    This would be perfect for me if it exists. Is there any possible way to track this information at all or any client/add-on feature that would allow this?

    Friday, July 13, 2018 8:06 AM

Answers

  • Nothing on Outlook's side. Mailbox auditing should help with that, however it needs to be enabled up front and the relevant AuditDelegate settings to be enabled.
    Friday, July 13, 2018 7:17 PM
  • Nothing on Outlook's side. Mailbox auditing should help with that, however it needs to be enabled up front and the relevant AuditDelegate settings to be enabled.

    Agree with Vasil, I would share more details:

    Enable the mailbox audit logging and add the AuditDelegate types, here are Move and MoveToDeletedItems.

    Set-Mailbox -Identity "<shared mailbox>" -AuditDelegate Move,MoveToDeletedItems -AuditEnabled $true


    Then search the audit log by running:

    Search-MailboxAuditLog -Mailboxes <shared mailbox> -LogonTypes Admin,Delegate


    Regards,

    Manu Meng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 16, 2018 10:12 AM
    Moderator

All replies

  • Nothing on Outlook's side. Mailbox auditing should help with that, however it needs to be enabled up front and the relevant AuditDelegate settings to be enabled.
    Friday, July 13, 2018 7:17 PM
  • Nothing on Outlook's side. Mailbox auditing should help with that, however it needs to be enabled up front and the relevant AuditDelegate settings to be enabled.

    Agree with Vasil, I would share more details:

    Enable the mailbox audit logging and add the AuditDelegate types, here are Move and MoveToDeletedItems.

    Set-Mailbox -Identity "<shared mailbox>" -AuditDelegate Move,MoveToDeletedItems -AuditEnabled $true


    Then search the audit log by running:

    Search-MailboxAuditLog -Mailboxes <shared mailbox> -LogonTypes Admin,Delegate


    Regards,

    Manu Meng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

    Monday, July 16, 2018 10:12 AM
    Moderator