Share via

audit logs

Glenn Maxwell 11,496 Reputation points
2024-11-11T22:20:55.82+00:00

Hi All,

I have a user in Exchange Online whose sent emails from the last one month (i.e., the sent items) are missing from users mailbox. The emails are not present in the Deleted Items or the Recoverable Items folder. Will the following syntax help me fetch the audit logs?

$date=((get-date).AddDays(-30)).ToShortDateString()
$Today=(get-date).ToShortDateString()  
Search-MailboxAuditLog [email protected] -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate $date -EndDate $Today | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding UTF8

If i need to export last 30 days sent emails to a pst how can i export please guide me.

Microsoft Exchange Online
Exchange Server
Exchange Server
A family of Microsoft client/server messaging and collaboration software.
1,346 questions
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,591 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,678 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
2,140 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce Jing-MSFT 5,870 Reputation points Microsoft Vendor
    2024-11-12T06:16:40.12+00:00

    Hi,@Glenn Maxwell

    Thanks for posting your question in the Microsoft Q&A forum.Based on your description, I don't think you have a problem providing multiple commands. Here is my test:

    User's image

    Export a CSV file, which is encoded in UTF8.

    User's image

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  2. Glenn Maxwell 11,496 Reputation points
    2024-11-13T04:02:05.2133333+00:00

    If i need to export last 30 days sent emails to a pst how can i export please guide me.

    0 comments
  3. Amit Singh 4,981 Reputation points
    2024-11-13T05:03:03.15+00:00

    You can use your PowerShell script with minor tweaks to search for mailbox audit logs that capture the send actions of the user. Make sure that mailbox audit logging is enabled. Use the Microsoft Purview Compliance Center or Content Search in Exchange Online to search for the sent emails in the last 30 days and export them to a PST file.

    Let me know if you need more specific details on any of these steps!

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.