How to use Office 365 Audit Log Search
You can use Office 365 Audit log search to track Admin events or mailbox owner events. In this post I will look at how you can use Audit log search to view who created a new inbox rule in a user’s mailbox.
To get started I will create a New inbox rule for a mailbox in my Office 365 Tenant.
The rule is as follows on the user’s mailbox and will mark all email from a certain user as read.
The following step would be to head over to Office 365 Security and Compliance Centre and Click on Search. Under search select Audit log search.
From the Audit log search portal, click on “Show results for all activities”.
In the search box, type “rule” to search for inbox rules. Select “New-InboxRule Create inbox rule from Outlook Web App”
Then specify the timeline for the search and then click search.
From the results section of the portal the Test rule will be listed.
To get more details on the rule, which was created, click on the search result. Here you will have some more information on who created the rule and when.
This is just a simple way of how you can use Audit log search to search for who created an Inbox rule in Outlook.
You can also use Audit log search to search who added a member to a Role in Office 365. This can be done by simple changing the search option and add “Added a group”.
Results will look as follow.
Just a few simple examples of how you can use Audit log search in Security and Compliance center to track changes in your Office 365 Tenant.
Be First to Comment