Home
Find out who deleted an email in Office 365 Shared Mailbox
Published: Thursday, 01 August 2019 | Categories: Office365 | Keywords: Powershell | Status: Posted | Created: Thursday, 01 August 2019 | Author: paul

To find out which user has deleted an email in a shared mailbox you can query the audit log with powershell. Connect to Exchange Online powershell session and the change the mailbox name and dates as appropriate.

Search-MailboxAuditLog -Identity [email protected] -LogonTypes Delegate -ShowDetails -StartDate 7/30/2019 -EndDate 8/1/2019 | select lastaccessed,operation,logonuserdisplayname,folderpathname,itemsubject | ft

You will then get back result in the format below:

LastAccessed        Operation          LogonUserDisplayName FolderPathName ItemSubject
------------        ---------          -------------------- -------------- -----------
01/08/2019 15:33:22 MoveToDeletedItems Paul Farris          \Inbox
01/08/2019 14:49:51 SoftDelete         Paul Farris          \Inbox
01/08/2019 14:22:53 SoftDelete         Paul Farris          \Deleted Items
01/08/2019 14:22:53 SoftDelete         Paul Farris          \Deleted Items
01/08/2019 14:22:52 SoftDelete         Paul Farris          \Deleted Items
01/08/2019 14:22:23 SoftDelete         Paul Farris          \Deleted Items
01/08/2019 14:17:52 SoftDelete         Paul Farris          \Inbox
01/08/2019 14:16:23 SoftDelete         Paul Farris          \Inbox
01/08/2019 14:16:23 SoftDelete         Paul Farris          \Inbox

Most operations should be returned but there may be a delay after the operations have been carried out before they can be queried in the audit log.


Add Comment
No Comments.