Hi,@Sanjay Bhakuni
Thanks for posting your question in the Microsoft Q&A forum.
Based on the current situation, I need to confirm a few things:
- is it known who created the meeting?
- did the user receive an invitation to the meeting?
Since a meeting can only be canceled by the person who created it, and since Audit log only records the creation of a meeting, I would suggest finding the user who created the meeting first.
Please refer to the process below:
- In the Audit screen of the Microsoft Purview portal, select the time of search and audit log activity by selecting “Created mailbox item”.
2.Find items in the search that contain calendars
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.