Office 365 audit logs show administrators what, who, where, when, and how of any event (user action) in their environment.īy default, audit logging is turned on for Office 365 and Microsoft 365 enterprise organizations.

You can check user log-in patterns, communication, file view, edit, and share actions.

To audit everything from every mailbox, run the following command: (Get-Mailbox).The Office 365 audit log is your go-to tool for tracking user and administrative activity in your tenant. To group mailboxes by what is enabled, run the following commands: $Group = $Mailboxes | Group-Object AuditEnabled,AuditDelegate | Select- Object Expression= $Group | Format-Table -AutoSize To get all mailboxes, run the following command: $Mailboxes = (Get-Mailbox) To enable the admin audit log, run the following command: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true To open the credentials prompt for O365, run the following commands: $Session = New-PSSession -ConfigurationName Microsoft.Exchange - ConnectionUri - Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session In the Windows PowerShell Credential Request dialog box, type your O365 user name and password, and then click OK.Open Windows PowerShell on your local system, and then run the following command: $UserCredential = Get-Credential Before mailbox auditing was turned on by default, you had to manually enable it for every user mailbox in your organization. This means that certain actions performed by mailbox owners, delegates, and admins are automatically logged, and the corresponding mailbox audit records will be available when you search for them in the mailbox audit log.

Starting in January 2019, Microsoft turned on mailbox audit logging by default for all organizations.

Log in o365