How to use Office 365 Audit Log Search

0
93
views

How to use Office 365 Audit Log Search

You can use Office 365 Audit log search to track Admin events or mailbox owner events. In this post I will look at how you can use Audit log search to view who created a new inbox rule in a user’s mailbox.

To get started I will create a New inbox rule for a mailbox in my Office 365 Tenant.

The rule is as follows on the user’s mailbox and will mark all email from a certain user as read.

A screenshot of a cell phone
Description automatically generated

The following step would be to head over to Office 365 Security and Compliance Centre and Click on Search. Under search select Audit log search.

From the Audit log search portal, click on “Show results for all activities”.

A screenshot of a social media post
Description automatically generated

In the search box, type “rule” to search for inbox rules. Select “New-InboxRule Create inbox rule from Outlook Web App

A screenshot of a social media post
Description automatically generated

Then specify the timeline for the search and then click search.

A screenshot of a cell phone
Description automatically generated

From the results section of the portal the Test rule will be listed.

A screenshot of a social media post
Description automatically generated

To get more details on the rule, which was created, click on the search result. Here you will have some more information on who created the rule and when.

A screenshot of a cell phone
Description automatically generated

This is just a simple way of how you can use Audit log search to search for who created an Inbox rule in Outlook.

You can also use Audit log search to search who added a member to a Role in Office 365. This can be done by simple changing the search option and add “Added a group”.

A screenshot of a cell phone
Description automatically generated

Results will look as follow.

A screenshot of a cell phone
Description automatically generated

Just a few simple examples of how you can use Audit log search in Security and Compliance center to track changes in your Office 365 Tenant.

Sharing is caring!

Previous articleCreate Office 365 Dynamic Distribution Group
Next articleConnect to Exchange servers using remote PowerShell
About Me ? I Guess i would start by saying i am a family guys and full time SysAdmin and Tech Junky. This Blog is my first attempt to share information about daily issues i come across as a SysAdmin as well as some new deployments i am part of. Topics that i will cover will mostly be about Office 365,Windows,Exchange as well as Active Directory. I hope some of my Blog posts helps someone #LiveLongAndBeLazy #Exchange #Office 365 #ActiveDirectory #Hyper-V
SHARE

LEAVE A REPLY

Please enter your comment!
Please enter your name here