Exchange Online PowerShell filter bug

Question

The Exchange Online PowerShell module seems to have a bug within the -Filter argument for Get-Mailbox. Specifically with the AuditEnabled property of a mailbox. I've tried the following:

Get-Mailbox -Filter 'AuditEnabled -eq $False'

Get-Mailbox -Filter "AuditEnabled -eq 'False'"

They don't seem to work though:

Using double quotes like Get-Mailbox -Filter "AuditEnabled -eq $False" just throws an error for invalid filter syntax so that's not it. Anyone seen this before?

Answer 1

The issue is not with the filter, but the property itself. A while back, Microsoft changed how this works in Exchange Online, where auditing is now enabled by default on the org level (and this overrides the per-user setting). Quote from the official documentation:

When mailbox auditing on by default is turned on for the organization, the AuditEnabled property for affected mailboxes won't be changed from False to True. In other words, mailbox auditing on by default ignores the AuditEnabled property on mailboxes.

Details are here: https://learn.microsoft.com/en-us/purview/audit-mailboxes

Answer 2

Try "AuditEnabled -eq `$False"

See: https://learn.microsoft.com/en-us/powershell/exchange/recipient-filters?view=exchange-ps#additional-opath-syntax-information

• System values: Don't enclose system values (for example, $true, $false, or $null). To enclose the whole OPATH filter in double quotation marks, you need to escape the dollar sign in system value (for example, `$true).