Commands › Exchange Online

New-MailboxAuditLogSearch

Exchange Online ExchangeOnlineManagement New-*

> [!NOTE] > This cmdlet will be deprecated in the cloud-based service. To access audit log data, use the Search-UnifiedAuditLog cmdlet. For more information, see this blog post: <https://aka.ms/AuditCmdletBlog>. Use the New-MailboxAuditLogSearch cmdlet to search mailbox audit logs and have search results sent via email to specified recipients.

Quick start script

# New-MailboxAuditLogSearch — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-MailboxAuditLogSearch
$before | Format-List

# 3. Make the change (dry run first)
New-MailboxAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty> -WhatIf
New-MailboxAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty>

# 4. Verify and diff
$after = Get-MailboxAuditLogSearch
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-MailboxAuditLogSearch -EndDate <ExDateTime> -StartDate <ExDateTime> -StatusMailRecipients <MultiValuedProperty>
 [-Confirm]
 [-DomainController <Fqdn>]
 [-ExternalAccess <Boolean>]
 [-GroupMailbox]
 [-HasAttachments <Boolean>]
 [-LogonTypes <MultiValuedProperty>]
 [-Mailboxes <MultiValuedProperty>]
 [-Name <String>]
 [-Operations <MultiValuedProperty>]
 [-ShowDetails]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	Required	What it controls
-EndDate	ExDateTime	yes	The EndDate parameter specifies the end date of the date range.
-StartDate	ExDateTime	yes	The StartDate parameter specifies the start date of the date range.
-StatusMailRecipients	MultiValuedProperty	yes	The StatusMailRecipients parameter specifies the email address where the search results are sent. You can specify multiple values separated by commas.
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn		This parameter is available only in on-premises Exchange.
-ExternalAccess	Boolean		The ExternalAccess parameter specifies whether to return only audit log entries for mailbox access by users that are outside of your organization. In Exchange Online, this parameter returns audit log entries for...
-GroupMailbox	SwitchParameter		This parameter is available only in the cloud-based service.
-HasAttachments	Boolean		The HasAttachments parameter filters the search by messages that have attachments. Valid values are:
-LogonTypes	MultiValuedProperty		The LogonTypes parameter specifies the type of logons. Valid values are:
-Mailboxes	MultiValuedProperty		The Mailboxes parameter specifies the mailbox to retrieve mailbox audit log entries from.
-Name	String		The Name parameter specifies a name for the search. The maximum length is 64 characters. If the value contains spaces, enclose the value in quotation marks (").
-Operations	MultiValuedProperty		The Operations parameter filters the search results by the operations that are logged by mailbox audit logging. Valid values are:
-ShowDetails	SwitchParameter		The ShowDetails switch specifies that details of each log entry are retrieved. You don't need to specify a value with this switch.
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.