This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(73.60000000000001, 2%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
With auditlogsearch we do get all kinds of operations like SoftDelete, HardDelete, MoveToDeletedItems etc.
But we had an issue were a lot of mails where moved to another folder.
Why doesn't a move operation show up in the auditlog?
I'm using the script on this page:
[https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/audit-logs/mailbox-audit-logs
Where Move should also be an operation that should be logged.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 31%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJX%3C/text%3E%3C/svg%3E)
Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the question has been answered, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.
Hi, you can enable with powershell:
Set-Mailbox <user> -AuditDelegate @{add="Move"}
Set-Mailbox <user> -AuditOwner @{add="Move"}
[https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-pshttps://learn.microsoft.com/en-us/powershell/module/exchange/set-mailbox?view=exchange-ps
Thank you for your answer.
I presumed a move action was also audited by default but that's not the case as I read now.
Did you enable owner logging?
[https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/audit-logs/mailbox-audit-logs#owner-mailbox-audit-logginghttps://learn.microsoft.com/en-us/microsoft-365/troubleshoot/audit-logs/mailbox-audit-logs#owner-mailbox-audit-logging
Sure, otherwise I wouldn't have any results.
I see a lot of actions like MoveToDeletedItems, Update, Create, SoftDelete and HardDelete, but no Move actions.
Even with tests on my own mailbox by moving messages to different folders, no move action is visible in the auditlog.
Ok, the reason I ask is because "move" is not enabled by default and needs to be added explictly, but it sounds like that has been done.
In our tenant Owner logging is enabled by default for every new user.
This is the first time I read it could clutter up the mailbox.
We are setting this for years now without any complaints.
But how can I explicitly enable "Move" actions for the auditlogging?
Or check if it is enabled.
Can't find that in the link.