Clarification on Exchange Online Audit Operations

New-FolderMoveRequest and Remove-FolderMoveRequest should be treated as server-side Exchange move-request events unless the raw record proves otherwise; they are not documented mailbox-item operations, and Microsoft does not publicly define their DB#... identifier format.

What the operations indicate

• They are not ordinary message moves. The documented mailbox operation for a user or delegate moving a message between folders is Move. Microsoft’s mailbox-audit catalog does not list New-FolderMoveRequest or Remove-FolderMoveRequest as mailbox actions.^1^
• They are not the documented EWS folder-move operation. A client moving an actual mailbox folder through EWS uses MoveFolder.^2^
• The names instead follow Exchange’s move-request lifecycle terminology: create a request and subsequently remove its request object. The closest documented public operation is New-PublicFolderMoveRequest, which moves public-folder contents between public-folder mailboxes; a completed request is later removed with Remove-PublicFolderMoveRequest.^3^^4^

However, the audit names are not identical to those public cmdlets. Therefore, they cannot conclusively be classified as public-folder moves—or normal mailbox migrations—from the operation name alone. They might represent internal Exchange Online work generated as part of a service-side move. Microsoft’s public audit activity catalog does not define either exact name.

End-user or administrative activity

First inspect RecordType:

• RecordType = 1 (ExchangeAdmin) means the record came from Exchange administrator auditing. For this record type, Operation is the cmdlet or administrative operation, and ObjectId is the object modified by it.^5^
• Exchange admin auditing records changes made through the Exchange admin center or Exchange Online PowerShell by an administrator or another identity assigned the required administrative permission.^6^
• Public-folder administration requires Exchange RBAC permissions such as Organization Management or Public Folder Management. It is not a normal mailbox-owner capability.^7^

Consequently, if these are ExchangeAdmin records, they were not caused directly by an ordinary user dragging a folder in Outlook. The actor could still be an administrator, an application, a delegated administrator, or an Exchange service identity. Use UserId, UserType, and ExternalAccess to distinguish those possibilities; UserId can identify a person or a system account, while ExternalAccess=True can indicate Microsoft datacenter personnel, a datacenter service account, or a delegated administrator.^8^

Meaning of OfficeObjectId and DB#...

For Exchange admin records, the schema defines the corresponding ObjectId as the name of the object modified by the operation.^5^

Microsoft does not publicly document the DB#... encoding used by these two operations. It therefore should not be interpreted conclusively as:

• a customer-visible Exchange Online mailbox database;
• a mailbox GUID;
• a mailbox’s current physical location; or
• a public-folder mailbox.

Although move requests can internally be associated with a request queue/database, and the documented RequestQueue parameter identifies the database where a request runs, that does not establish that every DB#... OfficeObjectId has the same meaning.^4^

Decode and correlate the record

Retrieve the raw AuditData rather than relying on exported summary columns:

$records = Search-UnifiedAuditLog `
  -StartDate $start -EndDate $end `
  -Operations "New-FolderMoveRequest","Remove-FolderMoveRequest" `
  -ResultSize 5000

$records | ForEach-Object {
    $a = $_.AuditData | ConvertFrom-Json
    [pscustomobject]@{
        Time       = $a.CreationTime
        Operation  = $a.Operation
        RecordType = $a.RecordType
        UserId     = $a.UserId
        UserType   = $a.UserType
        External   = $a.ExternalAccess
        ObjectId   = $a.ObjectId
        Parameters = ($a.Parameters | ConvertTo-Json -Compress)
    }
}

Search-UnifiedAuditLog returns the detailed event payload in AuditData.^9^ Correlate both operations by timestamp, actor, parameters, and any request GUID, mailbox GUID, source, or target fields. If the payload contains no customer-resolvable identifier, only Microsoft Support can authoritatively decode the internal DB#... value; provide both complete JSON records and their audit record IDs.

References

1. Manage mailbox auditing
2. MoveFolder operation
3. New-PublicFolderMoveRequest (ExchangePowerShell) | Microsoft Learn
4. Remove-PublicFolderMoveRequest (ExchangePowerShell)
5. Office 365 Management Activity API schema
6. Audit log activities
7. Feature permissions in Exchange Online
8. Detailed activity properties in the audit log
9. Search-UnifiedAuditLog (ExchangePowerShell) | Microsoft Learn