3 Methods to Audit Exchange Online Activity
Keeping track of Exchange Server activities helps you keep an eye on any configuration issues you might have and ensures your organization’s security and compliance requirements. Exchange Online provides both administrator action and mailbox logging. Admin actions record any administrators’ actions, while mailbox logging tracks access to the mailbox by an administrator or any other person.
As of January 2019, mailbox auditing is enabled by default for all organizations. Before this default setting, you had to turn on auditing for every user mailbox in the organization to get the full list of actions performed by administrators, mailbox owners, delegates, etc. Using a PowerShell cmdlet set made this relatively easy, but that was still an awkward process.
Exchange Audit Logs in Office 365
All Office 365 audit logs are unified into a single system, and Exchange logs are no different. To search for them, you’ll have to log on to Office 365 with an admin account, go to the Office 365 Security & Compliance or the newer Microsoft 365 compliance portal, and navigate to the Audit log search. You can find it either under Search -> Audit log search in the older center and just Audit in the latest one.
The user interfaces are arranged differently, but the components are pretty much the same in both cases. To access the Exchange events, you’ll want to open the Activities dropdown list, find the Exchange mailbox activities group, and select either the whole group or specific actions within this group. Clicking on Search will send your query to the service, and after a few moments, you should have the search results back.
Exchange Audit Logs in the Exchange Admin Center
Exchange Online has its own admin center with its set of audit reports. Under Compliance management -> Auditing, you can find several different reports. These reports are much more specific and smarter than the searchable ones in Office 365. They are more helpful if you know what kind of events you’re looking for. For example, one of the reports shows all configuration changes made by Microsoft or delegated admins, another shows changes made to In-Place eDiscovery and In-Place Holds, while a third one tracks all mailbox access by non-owners.
These reports won’t show any information that isn’t already available in the previous searchable logs, so you won’t be missing any events if you want to stick to them.
The Downsides of Office 365 and Exchange Online Center Reporting
None of the methods described here are terribly user friendly. The Security and Compliance Center’s audit log search contains all events made on your Office 365 tenant. That means you’ll need to know which events you’re searching for beforehand to get a meaningful Exchange report. Even when set up, scrolling through the events for additional info is a clunky process.
On the other hand, the Exchange admin center offers a number of very specific reports that effectively filter the Exchange audit log for a specific group of Exchange events. They’re powerful once you get used to them but are not easy to read.
How SysKit Point Helps with Exchange Online Audit
SysKit Point collects and stores all Office 365 audit logs automatically. While Exchange audit logs are not collected by default, SysKit Point can be easily set up to store them through the options. Once collected, the audit logs are kept locally for however long you need and can be accessed quickly and easily through our Office 365 auditing reports.
The reports are easy to find and can be set up to show all Exchange audit logs or just certain events related to specific mailboxes with very little fiddling with filters. SysKit Point also allows the export of those reports to a handy excel document if you so need it.
Want to read more posts from us? Subscribe to our blog and stay updated.
