Increase Audit Logs Age Limit For a Single Mailbox/ User Beyond 90 Days

By default in Exchange Online, it keeps the audit logs only for 90 days. This age limit can be increased using PowerShell:

Note: Mailbox will start to keep the logs beyond 90 days once after increasing the audit logs age limit. The mailbox will not provide you the logs from the previous timeframe.

Steps:

1. Run PowerShell as an Administrator.

2. Connect with Exchange Online module.

3. Run the below cmdlet:

Set-Mailbox -Identity "mailbox email address" -AuditLogAgeLimit Number Of Days

Example:

Set-Mailbox -Identity "[e-mail]" -AuditLogAgeLimit 365

To verify the audit logs age limit status, run the below cmdlet:

Get-Mailbox "[e-mail]" | Format-List Audit*