Commands › Exchange Online

Set-AdminAuditLogConfig

Exchange Online ExchangeOnlineManagement Set-*

Configure the administrator audit logging configuration settings.

Quick start script

# Set-AdminAuditLogConfig — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-AdminAuditLogConfig
$before | Format-List

# 3. Make the change (dry run first)
Set-AdminAuditLogConfig  -WhatIf
Set-AdminAuditLogConfig

# 4. Verify and diff
$after = Get-AdminAuditLogConfig
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

Set-AdminAuditLogConfig [[-Identity] <OrganizationIdParameter>]
 [-AdminAuditLogAgeLimit <EnhancedTimeSpan>]
 [-AdminAuditLogCmdlets <MultiValuedProperty>]
 [-AdminAuditLogEnabled <Boolean>]
 [-AdminAuditLogExcludedCmdlets <MultiValuedProperty>]
 [-AdminAuditLogParameters <MultiValuedProperty>]
 [-Confirm]
 [-DomainController <Fqdn>]
 [-Force]
 [-LogLevel <AuditLogLevel>]
 [-Name <String>]
 [-TestCmdletLoggingEnabled <Boolean>]
 [-UnifiedAuditLogIngestionEnabled <Boolean>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (14)

Parameter	Type	What it controls
-Identity	OrganizationIdParameter	This parameter is available only in on-premises Exchange.
-AdminAuditLogAgeLimit	EnhancedTimeSpan	This parameter is available only in on-premises Exchange.
-AdminAuditLogCmdlets	MultiValuedProperty	This parameter is available only in on-premises Exchange.
-AdminAuditLogEnabled	Boolean	This parameter is available only in on-premises Exchange.
-AdminAuditLogExcludedCmdlets	MultiValuedProperty	This parameter is available only in on-premises Exchange.
-AdminAuditLogParameters	MultiValuedProperty	This parameter is available only in on-premises Exchange.
-Confirm	SwitchParameter	The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-DomainController	Fqdn	This parameter is available only in on-premises Exchange.
-Force	SwitchParameter	The Force switch hides warning or confirmation messages. You don't need to specify a value with this switch.
-LogLevel	AuditLogLevel	This parameter is available only in on-premises Exchange.
-Name	String	This parameter is available only in on-premises Exchange.
-TestCmdletLoggingEnabled	Boolean	This parameter is available only in on-premises Exchange.
-UnifiedAuditLogIngestionEnabled	Boolean	This parameter is functional only in the cloud-based service.
-WhatIf	SwitchParameter	The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.