Mailbox Delegation - Audit Log

Question

Hello Support,

We have enabled auditing on our mailbox, which resulted returning the following email:

Activity: Add-MailboxPermission

User: NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)

Item: NAMPR04A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/domain-name.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-XXXX-XXXX-XXXX-...........}

Can someone please give me a brief explanation on why do we keep seeing NT AUTHORITY\SYSTEM adding itself to DiscoverySearchMailbox?

Regards,

BJ Balegar

Answer 1

Hi BJ Balegar,

This is system account. The user who performed the action (specified in the Operation property) that resulted in the record being logged. Note that records for activity performed by system accounts (such as SHAREPOINT\system or NT AUTHORITY\SYSTEM) are also included in the audit log.

For your reference: Detailed properties in the Office 365 audit log

Best regards,

Shyamal

Answer 2

Hi BJ Balegar,

No we cannot exclude a list of system users in the audit log. Here is one article for your reference. You can only search the result based on the filter. I think you may need to create some filters via Excel.

https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c#PickTab=HowTo

Best Regards,

Alison

Answer 3

Thank you again.

Answer 4

Thank you, Shyamal for your response. Is there a way to exclude a list of system users so it doesn't record in activity log?

Regards,

BJ Balegar