Increase Audit Logs Age Limit For all User Mailboxes Beyond 90 Days

By default in Exchange Online, it keeps the audit logs only for 90 days. This age limit can be increased using PowerShell:

Note: Mailbox will start to keep the logs beyond 90 days once after increasing the audit logs age limit. The mailbox will not provide you the logs from the previous timeframe.

Steps:

1. Run PowerShell as an Administrator.

2. Connect with Exchange Online module.

3. Run the below cmdlet to enable mailbox auditing for all user mailboxes in your organization and this is so if the auditing is disabled on any of the mailboxes, it will enable it:

Get-Mailbox -ResultSize Unlimited -Filter "RecipientTypeDetails -eq 'UserMailbox'" | Select PrimarySmtpAddress | ForEach {Set-Mailbox -Identity $_.PrimarySmtpAddress -AuditEnabled $true}

4. Now run the below cmdlet to increase the age limit for mailbox audit log entries for all user mailboxes in your organization:

Get-Mailbox -ResultSize Unlimited -Filter "RecipientTypeDetails -eq 'UserMailbox'" | Set-Mailbox -AuditLogAgeLimit Enter Days Value in Numeric

5. To verify the audit logs age limit status for all the user mailboxes, run the below cmdlet:

Get-Mailbox -ResultSize Unlimited -Filter "RecipientTypeDetails -eq 'UserMailbox'" | Format-List Name,Audit*