Hi @Vinh Nguyen ,
This was a much faster way to find what I was looking for .
Great to know that you've already thought of a solution and really appreciate it for your sharing!
By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:
[Who Deleted an Appointment from a Shared Calendar]
Issue Symptom:
M365 environment, an admin assistant wants to know who and when an appointment from a shared calendar was deleted. The appointment is currently sitting in the recoverable deleted items folder of the mailbox (username is Calendar) hosting the calendar. We have Mailbox Auditing turned on.
I just want to know who last modified this appointment located in the recoverable deleted items folder. Is it possible?
The Solution:
This was a much faster way to find what I was looking for (who\what\when deleted an appointment from the shared calendar named Coverage)
PS C:\> Search-MailboxAuditLog -ShowDetails -StartDate 8/3/2022 -EndDate 8/4/2022 | Where-Object {($.Operation -like "*Delete") -and ($.FolderPathName -like "*Calendar\Coverage")} |Select-Object LogonUserDisplayName, Operation, FolderPathName, SourceItemSubjectsList, LastAccessed
LogonUserDisplayName : User's Display Name
Operation : SoftDelete
FolderPathName : \Calendar\Coverage
SourceItemSubjectsList : Appointment Subject
LastAccessed : 8/3/2022 8:55:18 AM
You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks!