Exchange Online Mailbox Audit Logs "On" might not mean "On"(twitter.com)

1 pointsby fowl2vor 7 Monaten1 comments

Exchange Online Mailbox Audit Logs "On" might not mean "On"

https://twitter.com/itguysocal/status/2001383890574020648

1 comments

fowl2vor 7 Monaten

> When you run Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled, the AuditEnabled property always displays as True. This hardcoded display value doesn't reflect the actual mailbox-level audit configuration.

> To verify the actual mailbox audit status, use the Filter parameter in the following command: PowerShell

> Get-Mailbox -Identity <MailboxIdentity> -Filter "AuditEnabled -eq 'True'"| Format-List

> If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.

https://learn.microsoft.com/en-us/purview/audit-mailboxes?so...