'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix HTTP 401 Error When Running Search-MailboxAuditLog in Microsoft 365
Question details
The user needs to resolve an HTTP 401 Unauthorized error that occurs when attempting to run a mailbox audit log search on a specific shared mailbox.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Running the Search-MailboxAuditLog cmdlet in Exchange Online to retrieve audit logs for a shared mailbox.
- Observed behavior
- The command returns an HTTP 401 Unauthorized error for one isolated shared mailbox, despite audit logging being active and administrator roles being configured properly.
Ensure you have double-checked that your admin account possesses the necessary Audit Logs or View-Only Audit Logs roles in Exchange Online, and verify that audit logging is actually enabled for the affected shared mailbox.
Contact Microsoft 365 Support via Admin Center
Since the required roles are assigned and the error affects only a single shared mailbox, the issue is likely a backend synchronization or object corruption problem that requires intervention from the dedicated Exchange Online support team.
When an HTTP 401 error is isolated to a single mailbox despite correct global configurations, standard troubleshooting steps via PowerShell often cannot resolve the underlying tenant issue. Escalating the issue to Microsoft's backend engineering team is the most effective approach.
Open your web browser and log in to the Microsoft 365 admin center using your global administrator or Exchange administrator credentials.
On the left-hand navigation pane, locate and click on 'Support', then select 'New service request' from the dropdown menu.
Describe the HTTP 401 Unauthorized error occurring with the Search-MailboxAuditLog cmdlet, explicitly stating that it only affects one shared mailbox and that proper roles are already assigned. Submit the request for further investigation.
Looking for a Lightweight and Reliable Office Suite?
While resolving administrative backend issues in Microsoft 365 requires IT support, your daily document work doesn't have to be complicated. WPS Office is a free, lightweight, and user-friendly alternative that provides excellent compatibility with Microsoft Office formats for all your local document needs.
- 1. Download WPS Office: Visit the official WPS website to download the free installation package for your operating system.
- 2. Install the Application: Run the installer and follow the on-screen instructions to set up WPS Office on your computer.
- 3. Open and Edit Documents: Launch WPS Office and instantly open your existing .docx, .xlsx, or .pptx files without formatting loss.
Frequently Asked Questions
Why do I get an HTTP 401 error on only one shared mailbox?
This typically indicates a backend synchronization issue, an orphaned permission state, or corrupted object metadata specific to that shared mailbox in Exchange Online, which requires Microsoft support to investigate.
What roles are required to run Search-MailboxAuditLog?
You must be assigned the Audit Logs or View-Only Audit Logs role in Exchange Online. These roles are usually assigned by default to the Compliance Management and Organization Management role groups.
How can I verify if mailbox audit logging is enabled?
You can connect to Exchange Online PowerShell and run the command 'Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled' to check if audit logging is currently active for the specific mailbox.
