Use Auditing Reports in Exchange Online

  • Article

Applies to: Office 365 for professionals and small businesses, Office 365 for enterprises, Live@edu

Use audit logging to troubleshoot configuration issues by tracking specific changes made by administrators and to help you meet regulatory, compliance, and litigation requirements. Microsoft Exchange provides two types of audit logging:

  • Administrator audit logging records any action, based on a Windows PowerShell cmdlet, performed by an administrator. This can help you troubleshoot configuration issues or identify the cause of security- or compliance-related problems.
  • Mailbox audit logging records whenever a mailbox is accessed by someone other than the person who owns the mailbox. This can help you determine who has accessed a mailbox and what they have done.

This topic explains the following:

  • Export audit logs
  • Run auditing reports
  • Configure audit logging
    • Enable mailbox audit logging
    • Give users access to Auditing Reports
    • Configure Outlook Web App to allow XML attachments

Export audit logs

On the Auditing tab in the Exchange Control Panel, you can search for and export entries from the administrator audit log and the mailbox audit log.

  • Export the Administrator Audit Log   Any action performed by an administrator that is based on a Windows PowerShell cmdlet and doesn't begin with the verbs Get, Search, or Test is logged in the administrator audit log. Audit log entries include the cmdlet that was run, the parameter and values used with the cmdlet, and when the operation was successful. You can search for and export entries from the administrator audit log. When you export your search results, Microsoft Exchange saves them in an XML file and attaches it to an e-mail message.
  • Export Mailbox Audit Logs   When mailbox audit logging is enabled for a mailbox, Microsoft Exchange stores a record of actions performed on mailbox data by non-owners in the mailbox audit log, which is stored in a hidden folder in the mailbox being audited. Entries in this log indicate if the mailbox was accessed by someone other than the owner, who accessed the mailbox and when, the actions performed by the non-owner, and whether the action was successful. When you search for entries in the mailbox audit log and export them, Microsoft Exchange saves the search results in an XML file and attaches it to an e-mail message.

Note   For cloud-based organizations, audit log entries are kept for 90 days. When an entry is older than 90 days, it's deleted.

Run auditing reports

When you run any of the following reports on the Auditing tab in the Exchange Control Panel, the results are displayed in the details pane.

  • Run a Non-Owner Mailbox Access Report   Use this report to find mailboxes that have been accessed by someone other than the person who owns the mailbox. You can also use this report to determine if mailbox data in your cloud-based organizations is being accessed by Microsoft datacenter personnel.
  • Run a Litigation Hold Report   Use this report to find mailboxes that were put on or removed from litigation hold.
  • Run an Administrator Role Group Report   Use this report to search for changes made to administrator role groups.

Configure audit logging

Before you can run auditing reports and export audit logs, you have to configure audit logging for your organization

Enable mailbox audit logging

You have to enable mailbox audit logging for each mailbox that you want to run a non-owner mailbox access report for. If mailbox audit logging isn't enabled for a mailbox, you won't get any results for it when you run a report or export the mailbox audit log.

To enable mailbox audit logging for a single mailbox, run the following PowerShell command:

Set-Mailbox <Identity> -AuditEnabled $true

To enable mailbox auditing for all user mailboxes in your organization, run the following commands:

$UserMailboxes = Get-mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')}
$UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $true}

Give users access to Auditing Reports

By default, administrators can access and run any of the reports on the Auditing tab in the Exchange Control Panel. However, other users, such as a records manager or legal staff, have to be assigned the necessary permissions.

The easiest way to give users access is to add them to the Records Management role group. You can also use Windows PowerShell to give a user access to the Auditing tab by assigning the Audit Logs administrator role to the user. For more information, see Administrator Role Groups in Exchange Online and Built-in RBAC Roles for Exchange Online.

Add a user to the Records Management role group

  1. Select Manage My Organization > Roles & Auditing > Administrator Roles.
  2. In the list of role groups, click Records Management, and then click Details.
  3. Under Members, click Add.
  4. In the Select Members dialog box, select the user. You can search for a user by typing all or part of a display name, and then clicking Search icon. You can also sort the list by clicking the Name or Display Name column headings.
  5. Click Add and then click OK to return to the role group page.
  6. Click Save to save the change to the role group.

In the Details pane, the user is listed under Members and can access the Auditing tab in the Exchange Control Panel, run auditing reports, and export audit logs.

Assign the Audit Logs administrator role to a user

Run the following command to assign the Audit Logs administrator role to a user:

New-ManagementRoleAssignment -Role "Audit Logs" -User <Identity>

This enables the user to select Manage My Organization > Roles & Auditing > Auditing in the Exchange Control Panel to run any of the reports. The user can also export the mailbox audit log and administrator audit log.

Note   To allow a user to run auditing reports but not to export audit logs, use the previous command to assign the View-Only Audit Logs administrator role.

Configure Outlook Web App to allow XML attachments

When you export the mailbox audit log or administrator audit log, Microsoft Exchange attaches the audit log, which is an XML file, to an e-mail message. However, Outlook Web App blocks XML attachments by default. You have to configure Outlook Web App to allow XML attachments so that you can access the exported audit log.

Run the following command to allow XML attachments in Outlook Web App:

Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowedFileTypes '.rpmsg','.xlsx','.xlsm','.xlsb','.tiff','.pptx','.pptm','.ppsx','.ppsm','.docx','.docm','.zip','.xls','.wmv','.wma','.wav','.vsd','.txt','.tif','.rtf','.pub','.ppt','.png','.pdf','.one','.mp3','.jpg','.gif','.doc','.bmp','.avi','.xml'