Better way to build reporting on the Audit Log data?

Question

Hi,

I'm trying to pull records from users using sendAS to send mail from a shared mailbox.

I don't see this as an option from the Microsoft Graph API so I've been using the Office 365 Management API.

With this API, I need to:
Setup a subscription for the data
make an API request to pull a list of contentUris
loop through those contentUris to pull the actual data
sort through the data to find what I want

This data expires every 7 days so I need to pull it weekly and store the data somewhere.

Is there some other way to pull this information? I was able to get what I needed from PowerShell, but was asked to try Flows.

It just seems overly tedious and complicated for something you can easily get across any date range from the GUI version of the audit log.

Answer 1

For specific events, you're better off using PowerShell and the Search-UnifiedAuditLog cmdlet. Not sure how Flow will help in any way, either with PowerShell or the management APIs.

Answer 2

@Josh ADM

If you enable mailbox audit log in your organization, you will could find log from mailbox audit log: Mailbox actions for user mailboxes and shared mailboxes

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.