'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Audit MailItemsAccessed for Shared Mailboxes in Microsoft 365
Question details
Users need to retrieve MailItemsAccessed audit records for shared mailboxes in Microsoft 365 to monitor mailbox access.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Administrators are attempting to query audit logs to verify who accessed specific shared mailboxes for compliance and security purposes.
- Observed behavior
- MailItemsAccessed audit logs are successfully returned for standard user mailboxes but appear to be missing or inaccessible for shared mailboxes.
Ensure you have the necessary Exchange Online and compliance administrator permissions assigned, and verify that unified auditing is actively enabled for your Microsoft 365 tenant.
Verify Licensing and Run Unified Audit Log Search
Confirm the shared mailbox has the correct compliance licensing and use the Search-UnifiedAuditLog cmdlet instead of legacy commands.
The legacy Search-MailboxAuditLog cmdlet is deprecated and may not return accurate MailItemsAccessed events. Microsoft requires specific premium licenses to log these events, and all searches should now be conducted using the unified audit log.
Check the Microsoft 365 admin center to ensure the shared mailbox access is covered by an eligible Microsoft 365 E5, A5, G5, or a qualifying compliance add-on license.
Open PowerShell as an administrator and connect to Exchange Online using the Connect-ExchangeOnline cmdlet with your admin credentials.
Run the Search-UnifiedAuditLog cmdlet using ExchangeItem records. Specify the shared mailbox address, the required date range, and the applicable logon types.
Pipe the output of your unified audit log search to Export-Csv to save the MailItemsAccessed records locally for detailed compliance review.
Simplify Your Daily Document Work with WPS Office
While managing Microsoft 365 compliance rules and audit logs can be highly complex, your standard document management doesn't have to be. WPS Office offers a lightweight, free, and highly compatible alternative to Microsoft Office applications.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Suite: Run the lightweight installer and follow the on-screen instructions to complete the setup in minutes.
- 3. Open Your Office Files: Launch WPS Office and directly open your existing Microsoft Office documents without worrying about formatting issues.
Frequently Asked Questions
Why is the Search-MailboxAuditLog cmdlet returning empty results?
The Search-MailboxAuditLog cmdlet is deprecated by Microsoft. You must transition to using the Search-UnifiedAuditLog cmdlet to reliably retrieve current MailItemsAccessed and other mailbox audit records.
Do I need a special license to audit shared mailboxes?
Yes, to generate and log MailItemsAccessed events, the shared mailbox must be licensed with an eligible Microsoft 365 E5, A5, G5, or a specific advanced compliance add-on.
How long does it take for MailItemsAccessed events to show up?
Due to processing and ingestion times in Microsoft 365, audit events may experience a delay. It is recommended to wait up to 24 hours after the access occurred for the events to be fully searchable in the unified audit log.
