Soft-deleted items are moved to the Recoverable Items folder. Message was permanently deleted or deleted from the Deleted Items folder. Message was sent using the SendOnBehalf permission. Message sent using the SendAs permission. Message was deleted/moved to the Deleted Items folder. This action is also logged when the admin or delegate opens the mailbox.Ī message was purged from the Recoverable Items folder.Ī message was opened or viewed in the preview pane. Message and folder creation isn't audited.Ī mailbox folder was accessed. ActionĪn item is created in the Calendar, Contacts, Notes, or Tasks folder in the mailbox.

When auditing is enabled on a mailbox, the default actions are enabled. The results will resemble this screenshot:īelow are the actions that can be audited. To access the logs, log into the Office 365 portal and select Security & Compliance, Auditing and complete a search. The log is kept for 90 days if you need to keep the logs for a longer (or shorter) period, set the AuditLogAgeLimit parameter. Set-Mailbox alias -AuditOwner FolderBind, Move, MessageBind, SoftDelete 'With traditional approaches, it was very difficult to understand access to mailboxes and public folders across all the Exchange servers, effectively audit email access and communication, and find owners for public folders and mailboxes,' said Bernard Besohe, local mail and system administrator for the Publications Office of the European Union.

This cmdlet will log access to folders, messages that were moved, either opened or viewed in the reading pane, or deleted from Deleted items or using Shift+Delete. (Not all actions are supported for owners.) The reports can be downloaded as xls, csv, pdf or html files for further activities. In addition to generating these reports in the blink of an eye, one can also export these reports. To log actions by the mailbox owner, you need to enable the supported actions. Exchange Reporter Plus presents these reports in an easily comprehensible format that even technically naive users can create and interpret. When auditing is enabled, all actions by other users are logged but actions made by the mailbox owner are not logged. Set-Mailbox -Identity alias -AuditEnabled $true It needs to be enabled on specific mailboxes (or all mailboxes) by PowerShell to set the AuditEnabled parameter to true.

Exchange public folder auditing