'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Audit When Exchange Online Mailbox Permissions Were Granted
Question details
Administrators need to generate a report detailing when Exchange Online mailbox permissions (Full Access, Send As, Send on Behalf) were granted, including the date, user, and mailbox.
- Product
- Exchange Online
- Device & OS
- not provided
- Scenario
- Tracking and auditing mailbox permission changes for compliance and security monitoring.
- Observed behavior
- Extracting specific timestamps and permission types from Exchange Online audit data using PowerShell commands.
Ensure you have Exchange Administrator credentials and verify that unified auditing is actively enabled for your Microsoft 365 tenant before attempting to run audit scripts.
Use Exchange Online PowerShell Audit Commands
Leverage Exchange Online PowerShell to search audit logs for specific mailbox permission changes.
Because exact audit commands depend heavily on your tenant configuration, auditing retention policies, and specific output requirements, utilizing specialized PowerShell cmdlets is the most effective approach for retrieving these records.
Open PowerShell as an administrator and connect to Exchange Online PowerShell using your admin credentials.
Run the `Search-UnifiedAuditLog` cmdlet, filtering for operations like 'Add-MailboxPermission' (for Full Access) or 'Add-RecipientPermission' (for Send As).
Pipe your results to display or export the creation date, the user who granted the permission, the target mailbox, and the specific permission type applied.
For exact scripting tailored to your date range, tenant environment, and required output fields, post your request in the Microsoft Q&A PowerShell community at https://learn.microsoft.com/en-us/answers/tags/426/powershell.
Looking for a Lightweight Alternative to Microsoft Office?
While managing Exchange Online requires Microsoft administration tools, your daily document and compliance reporting tasks don't have to be tied to expensive Office subscriptions. WPS Office provides a free, highly compatible, and lightweight suite for all your Word, Excel, and PowerPoint needs.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Suite: Run the downloaded executable file and follow the on-screen instructions to install the software.
- 3. Open Your Reports: Launch WPS Spreadsheet to instantly open and analyze your exported Exchange Online audit CSV files.
Frequently Asked Questions
Why can't I see older mailbox permission changes in my audit logs?
By default, Microsoft 365 retains audit logs for a limited time (often 90 to 180 days, depending on your licensing). If the permission was granted before this retention period, it will no longer appear in the audit search results.
Do I need special permissions to run Exchange Online audit scripts?
Yes, you must be assigned the View-Only Audit Logs or Audit Logs role in Exchange Online. These roles are typically granted to Global Administrators or Compliance Administrators by default.
What is the difference between Add-MailboxPermission and Add-RecipientPermission in the logs?
The 'Add-MailboxPermission' operation is generally used to log when Full Access rights are granted to a mailbox, whereas 'Add-RecipientPermission' is specifically logged when 'Send As' rights are assigned.
