Hello! Is it possible audit a shared Mailbox ? how to check who add or remove any member, etc etc? Any tip on office admin center or by powershell? Thank you

Hi @ALVES Ricardo but still I can not find out where I can see who was added or removed from a specific shared mailbox. Include the following actions and enter the alias of the shard mailbox into the box of "keyword search" when searching the audit logs via Microsoft Purview-Audit: Added delegate mailbox permissions Removed delegate mailbox permissions You would be able to see who was added or removed from the shared mailbox in the details pane: If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Ensure auditing is enabled in Exchange Online ( it should be) and audit what is needed: https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-mailboxes?view=o365-worldwide

You can run this: Examples: Search-UnifiedAuditLog -ObjectIds <SharedMBX Identity>-StartDate 03/21/2023 -EndDate 03/25/2023 Search-AdminAuditLog -ObjectIds <SharedMBX Identity> -StartDate 03/01/2023 -EndDate 03/25/2023

Audit Shared Mailbox - Microsoft Q&A

Accepted answer

Yuki Sun-MSFT 40,856 Reputation points

2023-03-24T02:59:15.54+00:00
Hi @ALVES Ricardo

but still I can not find out where I can see who was added or removed from a specific shared mailbox.

Include the following actions and enter the alias of the shard mailbox into the box of "keyword search" when searching the audit logs via Microsoft Purview-Audit:

Added delegate mailbox permissions

Removed delegate mailbox permissions

You would be able to see who was added or removed from the shared mailbox in the details pane:

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
ALVES Ricardo 106 Reputation points

2023-03-24T10:24:10.8833333+00:00

Hello Yuki

I followed your steps but I did not get any results

Can you double check if I did anything wrong?

On Keyword Search I inserted my shared mail box

On Activities: I inserted "Added delegate mailbox permissions" and "removed delegate mailbox permissions"

Date and time: was yesterday

And I got 0 results.

Note: yesterday I added a user, removed him and I added him again. So I should have got at least 3 results

Andy David - MVP 141.6K Reputation points MVP

2023-03-24T11:42:45.8+00:00

How did you add and remove a user specifically?

ALVES Ricardo 106 Reputation points

2023-03-24T11:46:57.71+00:00

I did it on Exchange Admin Center (the new one)

Yuki Sun-MSFT 40,856 Reputation points

2023-03-24T12:48:34.0633333+00:00

On Keyword Search I inserted my shared mail box

Did you insert the entire address of the shared mailbox? Like "shared1@contoso.com"? If yes, please enter the alias only, such as "shared1" in my sample. In case this still doesn't work, leave Keyword Search blank and check if you can get any results.

Andy David - MVP 141.6K Reputation points MVP

2023-03-24T14:03:47.2033333+00:00

Yes, but how did you add and remove a user specifically? What did you do to give them permissions then remove those permission? What perms were added.

ALVES Ricardo 106 Reputation points

2023-03-24T15:23:55.4566667+00:00

Hello Yuki,

It worked now.

What I did was on Keyword Search I inserted "ricardoteste**", basically I added the "" and it worked.

Thank you so much Yuki and Andy

Yuki Sun-MSFT 40,856 Reputation points

2023-03-27T01:03:26.5+00:00

What I did was on Keyword Search I inserted "ricardoteste**", basically I added the "" and it worked.

Hi @ALVES Ricardo ,

Great to know that it worked now and appreciated it for the share!

By the way, if the reply above has been helpful, do you mind accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community? Thank you for helping to improve Microsoft Q&A!
Sign in to comment

Audit Shared Mailbox

2 additional answers