Report to see if a specific Outlook Web user opened a (non sharepoint/non one-drive) email attachment

Question

We use Microsoft 365 hybrid deployment. We are trying to run reports to see when team members who have access to Outlook Web when off premises open email attachments or download email attachments. The report we found will show if the user opens an attachment that is stored on Sharepoint or One Drive; however, I would like to see all attachments that are opened by the user when he/she is not on premises. We are able to see when the user logs in using Outlook Web and the IP address. Does anyone know of a report or a powershell script I can run?

Answer 1

Hi @M Ward ,

Welcome to our forum!

From your description, I understand that you want to view a record of a specific user logging in from the web and accessing attachments. If there is any misunderstanding, please feel free to let me know.
Based on my research, you can use the audit log search tool in the Microsoft Purview compliance portal to search for, view, and export (to a CSV file) the audit records for these operations.

You can click on each one to see the specific details

More information, see:

Search the audit log
Export, configure, and view audit log records

Besides, according to my test on PowerShell, you can use commands to view folder data which is accessed by a user, as shown in the screenshot below, attachment items that
the user access does not appear, however you can according to the message header to locate the email.

Search-MailboxAuditLog -Identity test01 -LogonTypes Owner -StartDate 12/12/2022 -EndDate 12/13/2022 -ResultSize 2000 -ShowDetails | where{$_.Operation -eq "MailItemsAccessed"} | fl AggregatedRecordFoldersData  

For information about the parameter sets in New-MailboxAuditLogSearch
Hope that may help you!