Issue:
A shared mailbox is accessed by 5 - 7 users, need to know which user moved an email between folders.
Analysis:
For the initial diagnostics we would like you to perform and share the results of below mentioned powershell commands and share the output with us.
1) Connect to Exchange Online via PowerShell.
2) Execute the command Get-OrganizationConfig | Format-List AuditDisabled if the returned value is False it indicates the mailbox auditing is enabled for your organization.
3)This command will be used to see what actions are enabled for auditing:
Get-Mailbox -Identity <MailboxIdentity> | Format-List DefaultAuditSet
Below is the link for reference article:
Resolution:
To review your audit logs using Security and Compliance Center kindly follow these steps:
Sign in to theSecurity & Compliance Centerwith your Office 365 Admin account.
Select Search & Investigation, and then select Audit log search.
Select the activities you want to audit. For example, mailbox activities such as one or more users signing into their mailbox or purging email.
If you want to see synchronization activities for SharePoint Online or OneDrive, choose Synchronization activities. If you want to see when files are checked in, accessed, shared, or renamed in SharePoint Online and OneDrive, choose File and folder activities.
You can only view events that happened after you turned on auditing in Office 365. Mailbox auditing is included in the Audit log search, but you must turn on mailbox auditing separately. For more information, see the previous tab: Enable mailbox auditing.
For reference: https://support.microsoft.com/en-us/help/4026501/office-auditing-in-office-365-for-admins
To review using Power shell commands follow this article:
Comments
0 comments
Please sign in to leave a comment.