but still I can not find out where I can see who was added or removed from a specific shared mailbox.
Include the following actions and enter the alias of the shard mailbox into the box of "keyword search" when searching the audit logs via Microsoft Purview-Audit:
- Added delegate mailbox permissions
- Removed delegate mailbox permissions
You would be able to see who was added or removed from the shared mailbox in the details pane:
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.