Where I can find Exchange Online admin logs

Question

Where I can find Exchange Online admin logs, in particular I need to find out who and when deleted / created Exchange Online Connectors

Thanks
Michael

Answer 1

Use the Search-AdminAuditLog cmdlet, or the corresponding UI: https://learn.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-administrator-audit-log
For example:

Search-AdminAuditLog -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date).AddDays(1) -Cmdlets New-OutboundConnector,Remove-OutboundConnector  

Alternatively, you can use the Unified audit log experience: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

Answer 2

Thanks Michev.

It worked at PowerShell v5 just needed to add "New-InboundConnector, Remove-InboundConnector" to get what I was looking for

It didn't worked at my PowerShell v7though: it didn't get the date via (Get-Date).AddDays(xx), see the attached screenshot

Answer 3

@Michael Vavilov

Glad to see it works for you. If the above suggestion helps, please feel free to accept it as an answer to close this thread. It also could be beneficial to other community members reading this thread.

Here are tests in my lab (Get-Date could work in PS V7.2.3):

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 4

thanks all