none
Office 365 deleted email audit RRS feed

  • Question

  • Hi there, I would like to search for user id who deleted emails from Office 365. I tried to search in protection.microsoft.com as mentioned in the link. I got quiet a lot of search results. Is there a better way find by using different search criteria (such as email subject) or by using powershell script in order which user id deleted few emails. Please share some resources and appreciate your assistance. 

    VT


    Thursday, December 5, 2019 2:40 AM

Answers

All replies

  • Hi,

    Thanks for visiting our forum, here we mainly focus on general issues about Outlook desktop client but your question is more related to Exchange online. So I'll move your thread to the dedicated forum for Exchange online.

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thanks for your understanding and hope your question will be resolved soon.

    Regards,

    Aidan Wang


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, December 5, 2019 7:09 AM
  • Hi,

    We usually use Search-MailboxAuditLog command to search for mailbox audit log entries matching the specified search terms.

    We can specify the parameters like -Mailboxes -LogonTypes -Operations and so on.

    For example, we can use the following command to search for the mailbox audit log and export the result to a txt file, in the file we can search for the subject or other detailed information you need: 

    Search-MailboxAuditLog -Identity username -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate 11/30/2019 -EndDate 12/6/2019 >c:\xx\xx.txt

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, December 5, 2019 8:50 AM
  • Hi,

    Is there any update about your issue?

    Regards,

    Joyce Shen


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, December 9, 2019 1:19 AM
  • Hi Joyce...Thank you for your reply. This article helped me. 

    VT

    • Marked as answer by mywindows Tuesday, December 10, 2019 5:22 PM
    Tuesday, December 10, 2019 5:22 PM