How can I find who created an event on a shared calendar in the new Outlook?

Have a Microsoft 365 administrator search Microsoft Purview Audit for the calendar item’s Create event, because the new Outlook tracking pane is for meeting responses and does not provide a creator-history view for shared-calendar items.

Search in Microsoft Purview Audit

The administrator needs the Audit Logs or View-Only Audit Logs role. These can be checked under Microsoft Purview portal → Settings → Roles and scopes → Role groups.^1^

1. Open Microsoft Purview → Audit → Search.
2. Set Date and time range to when the event was probably created, not the event’s scheduled date. Audit timestamps use UTC.
3. Under Activities, select Created mailbox item. Its underlying operation is Create, which covers items created in Calendar folders, including new meeting requests.^2^
4. Apply the mailbox filter appropriate to the calendar:
   • Calendar in a shared mailbox: Enter the shared mailbox’s primary SMTP address in Keywords, not Users.
   • A user’s calendar shared with colleagues: Enter the calendar owner’s mailbox under Users.
5. Run the search, open matching Create records, and compare their creation time and item details with the anonymous event. The record identifies the account responsible for the audited action.

Mailbox auditing is enabled by default in Microsoft 365 organizations, and Create is audited by default for delegate and administrator access to user and shared mailboxes.^3^

Exchange Online PowerShell alternative

For a calendar stored in a shared mailbox, search the mailbox rather than putting its address in -UserIds:

$start = [datetime]"2026-11-01T00:00:00Z"
$end   = [datetime]"2026-11-08T00:00:00Z"
$mailbox = "[Email]"

Search-UnifiedAuditLog `
  -StartDate $start -EndDate $end `
  -FreeText (Get-Mailbox $mailbox).ExchangeGuid `
  -Operations Create `
  -ResultSize 5000 |
  Format-List CreationDate,UserIds,Operations,AuditData

-UserIds searches for actions performed by a specified user; it is not the correct way to find all delegate actions performed inside a shared mailbox. Microsoft documents -FreeText with the mailbox Exchange GUID for that scenario.^4^ Search-UnifiedAuditLog requires appropriate permissions and is available only in the cloud service.^5^

If no record is returned

• Standard audit data is retained for 180 days by default. Older creation activity is unavailable unless the organization has applicable Audit Premium licensing or a longer retention policy.^1^
• Confirm auditing was active:

Get-OrganizationConfig | Format-List AuditDisabled
Get-Mailbox -Identity "[Email]" |
    Format-List DefaultAuditSet

AuditDisabled : False means organization-level mailbox auditing is enabled. DefaultAuditSet shows whether Microsoft’s default Admin, Delegate, and Owner action sets apply.^3^

If the item predates retained audit data, Outlook itself cannot reconstruct a historical creator identity from the visible event. For future entries, consider requiring users to add their initials to the event body or category, while retaining auditing for formal investigations.

References

1. Search the audit log for mailbox activities in specific mailboxes
2. Audit log activities
3. Manage mailbox auditing
4. Search the audit log to investigate common support issues
5. Search-UnifiedAuditLog-Syntax