Edit distribution list delivery management settings - Audit

Question

Hi All,

Is it possible to find out or audit who or when a user was removed from the specified senders list under distribution list delivery management?

Answer 1

Hello @DT_2026

You can try to determine who made the change and when it occurred by reviewing the audit logs in Microsoft 365. Please follow the steps below and refer to the attached screenshot for additional guidance.

• Sign in to the Microsoft Purview portal.
• Select the "Audit" solution card. If the "Audit" solution card isn't displayed, select View all solutions and then select "Audit" from the Core section.
• Go to "Audit" and perform a search for activities related to Distribution Group modifications.
• Filter the search by:
  • The affected Distribution Group
  • The relevant time period
• Review the audit records to identify:
  • The account that performed the change
  • The date and time of the change
  • Details of the Distribution Group update

In this case, you can review the audit record details for changes to (For example):

• Activities - operation names: Set-DistributionGroup
• Workloads: Exchange
• Keyword Search: Distribution Group name or email address
• Users: Leave blank if the administrator who made the change is unknown

Search the audit log | Microsoft Learn

Note:

• If the change occurred outside the audit retention period, or if no audit record is available for the event, it may not be possible to determine exactly who made the change or when it occurred.
• Please ensure the account performing the audit log search has the appropriate permissions (for example, Audit Reader, Audit Manager, Compliance Administrator, or Global Administrator) to access and review audit records.

If you get stuck while trying the steps above, please share a screenshot or provide more detailed information. I will check the situation and continue to support you. 

Kind regards, 

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.