question

Kallb-3662 avatar image
0 Votes"
Kallb-3662 asked KyleXu-MSFT commented

How can I edit the Run-MailboxAuditLogSearcher.ps1 script to show Sender and Message ID as an output?

Microsoft has a basic script you can run on PowerShell to spit out audits of mailboxes to a .csv. The problem is The .csv does not include the message ID, so I can match it up with the id that shows up in message trace, and it does not show the sender's email address.

Hoping someone can show me what I need to edit in the .ps1 so it can include those things. The link below is where I got the auditlog.ps1


https://docs.microsoft.com/en-us/office365/troubleshoot/audit-logs/mailbox-audit-logs

office-outlook-itprooffice-exchange-online-itpropower-query-not-supported
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

KyleXu-MSFT avatar image
0 Votes"
KyleXu-MSFT answered KyleXu-MSFT commented

@Kallb-3662

The mailbox audit log is used to record the operation that mailbox owner and delegates done to mailbox. Such as, someone delete an email from this mailbox, move email from one folder to another folder, and add/remove access permission for folder. For more detailed information, you can have a look about this article: Auditing reports in the Exchange admin center in Exchange Online

So, there doesn't exist "Message ID" and "Sender Email address" by default. They are used for Message trace log rather than mailbox audit log.


If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@Kallb-3662
I am writing here to confirm with you any update about this thread now?
If the above suggestion helps, please be free to mark it as an answer for helping more people.

0 Votes 0 ·