Commands › Exchange Online

Search-MailboxAuditLog

Exchange Online ExchangeOnlineManagement Search-*

> [!NOTE] > This cmdlet will be deprecated in the cloud-based service. To access audit log data, use the Search-UnifiedAuditLog cmdlet. For more information, see this blog post: <https://aka.ms/AuditCmdletBlog>. Use the Search-MailboxAuditLog cmdlet to search mailbox audit log entries matching the specified search terms.

Quick start script

# Search-MailboxAuditLog — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Run and inspect
Search-MailboxAuditLog | Format-List

# 3. Export for evidence / drift tracking
Search-MailboxAuditLog | Export-Clixml .\MailboxAuditLog-$(Get-Date -Format yyyyMMdd).xml

Syntax — 2 parameter sets

Identity

Search-MailboxAuditLog [[-Identity] <MailboxIdParameter>]
 [-ShowDetails]
 [-DomainController <Fqdn>]
 [-EndDate <ExDateTime>]
 [-ExternalAccess <Boolean>]
 [-GroupMailbox]
 [-HasAttachments <Boolean>]
 [-IncludeInactiveMailbox]
 [-LogonTypes <MultiValuedProperty>]
 [-Operations <MultiValuedProperty>]
 [-ResultSize <Int32>]
 [-StartDate <ExDateTime>]
 [<CommonParameters>]

MultipleMailboxesSearch

Search-MailboxAuditLog [-Mailboxes <MultiValuedProperty>]
 [-DomainController <Fqdn>]
 [-EndDate <ExDateTime>]
 [-ExternalAccess <Boolean>]
 [-GroupMailbox]
 [-HasAttachments <Boolean>]
 [-IncludeInactiveMailbox]
 [-LogonTypes <MultiValuedProperty>]
 [-Operations <MultiValuedProperty>]
 [-ResultSize <Int32>]
 [-StartDate <ExDateTime>]
 [<CommonParameters>]

Parameters (13)

Parameter	Type	What it controls
-Identity	MailboxIdParameter	The Identity parameter specifies a single mailbox to retrieve mailbox audit log entries from. You can use any value that uniquely identifies the mailbox. For example:
-DomainController	Fqdn	This parameter is available only in on-premises Exchange.
-EndDate	ExDateTime	The EndDate parameter specifies the end date of the date range.
-ExternalAccess	Boolean	The ExternalAccess parameter specifies whether to return only audit log entries for mailbox access by users that are outside of your organization. In Exchange Online, this parameter returns audit log entries for...
-GroupMailbox	SwitchParameter	This parameter is available only in the cloud-based service.
-HasAttachments	Boolean	The HasAttachments parameter filters the search by messages that have attachments. Valid values are:
-IncludeInactiveMailbox	SwitchParameter	This parameter is available only in the cloud-based service.
-LogonTypes	MultiValuedProperty	The LogonTypes parameter specifies the type of logons. Valid values are:
-Mailboxes	MultiValuedProperty	The Mailboxes parameter specifies the mailboxes to retrieve mailbox audit log entries from. You can use this parameter to search audit logs for multiple mailboxes.
-Operations	MultiValuedProperty	The Operations parameter filters the search results by the mailbox actions that are logged by mailbox audit logging. Valid values are:
-ResultSize	Int32	The ResultSize parameter specifies the maximum number of mailbox audit log entries to return. Valid values include an integer from 1 through 250000. By default, 1000 entries are returned.
-ShowDetails	SwitchParameter	The ShowDetails switch retrieves the details of each log entry from the mailbox. You don't need to specify a value with this switch.
-StartDate	ExDateTime	The StartDate parameter specifies the start date of the date range.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.