How to check when the user got access to shared mailbox

Question

Mani 446

Hello all,

Is there a way to check when the user got access to shared mail box using powershell or EAC?

Accepted answer

0 additional answers

Answer 1

Vasil Michev 119.5K MVP Volunteer Moderator

Here's the corresponding PowerShell cmdlet:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -Operations Add-MailboxPermission

Alternatively, you can also query the Exchange admin audit log:

Search-AdminAuditLog -Cmdlets Add-MailboxPermission

Make sure to narrow down the search by leveraging the date and objectId parameters.

Mani 446 Reputation points

2023-05-29T06:11:22.7466667+00:00

Hello @Vasil Michev

Thanks for your response, is there any way to find it for more than 90 days period?
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator

2023-05-29T07:57:36.8366667+00:00

Depends on the method you're using and the license you have. E5 tenants keep the Unified audit log entries for 1year.
Mani 446 Reputation points

2023-05-29T08:01:21.1633333+00:00

Shared mailbox without any license and the user assigned is having E3 license
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator

2023-05-29T08:31:10.8133333+00:00

The mailbox license doesn't matter here, it's the overall tenant feature set that does. If you only have E3 licenses, 90 days is the maximum you can get.
Mani 446 Reputation points

2023-05-31T10:32:06.8066667+00:00

Will microsoft help in this case? if i raise a service request to them
Vasil Michev 119.5K Reputation points MVP Volunteer Moderator

2023-05-31T17:06:55.63+00:00

I doubt it, as they don't keep data indefinitely and have to dispose of it as disclosed. But nothing is stopping you from opening a support case and asking.