How do I find a specific change in an audit log?
Detailed system audit logs contain so much information that tracking down a specific change or finding out if another employee account accessed a mailbox or calendar becomes difficult. This sheer volume of data makes it hard to troubleshoot unexpected edits when multiple people are involved.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
- 1Locking books with a password each month
- 2Using Exchange Online PowerShell with Search-UnifiedAuditLog and specific parameters instead of the admin center UI
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“How can I track down if any other employee accounts have accessed that mailbox/calendar in the last 180 days?”source ↗
“Yes, with so much detailed information it can definitely be difficult to find the specific change you are looking for.”source ↗
Where this came up
People with this problem also raised
- 5How to stop juggling bookmarks for admin tools and reference sites
- 7How do you do account reconciliation when departments are split up?
- 3How to find a lost financial account with no paperwork
- 3Why do ad campaign numbers keep changing after the fact?
- 2How to make sure I found all the ticks on my dog
- 2How to track historical data in CRM without a data warehouse