Quick Reference Guide

Exchange Online Auditing

This quick reference guide shows how to enable logging of important changes in
Exchange Online

Exchange Online Audit Settings

Exchange Online auditing is enabled by default and cannot
be deactivated.

Review Audit Logs in Exchange Online

Common Cmdlets:

Open the Exchange Admin Center in your browser and navigate

to Compliance Management > Auditing.
Click Run the admin audit log report...
Specify the date range and choose the cmdlets you want to report
on from the Common Cmdlets box.
The User eld shows the admin who executed the cmdlet. The
Parameters eld provides detailed information, such as which
permissions to which mailbox were changed and who received them.

Search Audit Logs using Exchange

Management Shell or PowerShell Console

Enable-Mailbox Creates a
mailbox for an existing AD user

Disable-Mailbox Removes users

mailbox

Set-Mailbox Modies the settings

of an existing mailbox

New-MailboxDatabase Creates a
new mailbox database

Mount(Dismount)-Database
Mounts or dismounts an existing
mailbox database

Open the Exchange Management Shell or PowerShell

as Administrator.
Connect to your Exchange Online using the following commands:
Set-ExecutionPolicy RemoteSigned
$credential = Get-Credential #enter your exchange online credentials
$exchangeSession
=
New-PSSession
-CongurationName
Microsoft.Exchange -ConnectionUri "https://outlook.oce365.com/
powershell-liveid/" -Credential $credential -Authentication "Basic" AllowRedirection #connect to exchange online
Import-PSSession $exchangeSession -DisableNameChecking #import
scripts and cmdlets for management
To search the Admin audit log, run the following cmdlets:
Search-AdminAuditLog
New-AdminAuditLogSearch
You can specify search dates by adding Parameters StartDate
MM/DD/YYYY EndDate MM/DD/YYYY
You can also use other cmdlets and parameters. Run get-help
Search-AdminAuditLog for more information.

Set-MailboxDatabase Congures
a variety of properties for a mailbox
database

New-SendConnector - Creates a
new Send connector

New-ReceiveConnector - Creates a
new Receive connector

Add(Remove)-MailboxPermission
Adds or removes permissions to a
mailbox
You can nd full list of cmdlets hereurl2open.com/cmdlets

Gain #completevisibility into all activity in hybrid cloud IT environments

with Netwrix Auditor for Oce 365: netwrix.com/go/trial-o365

Corporate Headquarters:

Phone: 1-949-407-5125

Int'l: 1-949-407-5125

300 Center Drive, Suite 1100, Irvine, CA 92618

Toll-free: 888-638-9749

EMEA: 44 (0) 203-318-0261

netwrix.com/social