Subject seems new, Right..

No, No…. I didn’t delete this Email, Show me Audit logs, Well.. Now we can.. 🙂

Office365 now supports Mailbox audit logs for Owner as well, How to do so, Just follow below steps:

  1. Connect to Exchange Online Powershell
  2. Run below commands:

Search-MailboxAuditLog -ShowDetails -LogonTypes Owner | ft Operation,Client*,LastAccessed

There are lot more can be retrieved as you can specify StartDate EndDate Etc.

Operation parameter returns below values, You can check the ClientIP to find from where user logged in.

  • Create
  • FolderBind
  • HardDelete
  • MailboxLogin This value is available only in Exchange 2016, and only when the LogonTypes parameter value Owner is also specified.
  • MessageBind
  • Move
  • MoveToDeletedItems
  • SendAs
  • SendOnBehalf
  • SoftDelete
  • Update

Feel free to comment for any questions.



By Kingson Jebaraj

Microsoft MVP, Blogger, Owner and Publisher for, Microsoft TechNet Author, Solution Architect, Former Office365 Technical Lead for Microsoft(Partner) Extensive knowledge and experience in Microsoft Exchange and Cloud Messaging Services and has got more exposure on Messaging environment deployment,migration,designing and other project management activities, I have earned real time experience in handling multi-site distributed critical large environment of messaging system. Been awarded as an MVP (Microsoft Most Valuable Professional) for Office Servers and services from Microsoft for an exceptional real world contribution made through Microsoft forums and other Microsoft communities. Currently working as “Solution Architect” on Private/Public cloud and SaaS environment for Pacific Controls, UAE, Dubai. One of the largest TIER III certified green data center campus in the middle east.

Leave a Reply

Your email address will not be published. Required fields are marked *