Enable Mailbox Auditing via Powershell for 365

Enable mailbox auditing in Office 365

https://technet.microsoft.com/en-us/library/dn879651.aspx

 

Step 1: Install required software

 

These steps are required once on your computer, not every time you connect. However, you’ll likely need to install newer versions of the software periodically.

 

1.Install the 64-bit version of the Microsoft Online Services Sign-in Assistant: Microsoft Online Services Sign-in Assistant for IT Professionals RTW.

https://go.microsoft.com/fwlink/p/?LinkId=286152

 

2.Install the 64-bit version of the Windows Azure Active Directory Module for Windows PowerShell with these steps:

 

Open the Azure Active Directory Connection web page.

In Files in Download at the bottom of the page, click Download for the AdministrationConfig-V1.1.166.0-GA.msi file, and then install it.

 

http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185

 

 

Login to Office 365 using Windows Azure Active Directory for Windows Powershell (Right click and run as Administrator)

 

1. Set-ExecutionPolicy RemoteSigned
2. Import-Module MSOnline
3. $O365Cred = Get-Credential
4. $O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
5. Import-PSSession $O365Session
6. Connect-MsolService –Credential $O365Cred

 

Enable all Mailboxes for Auditing to True:

7. Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditEnabled $true

 

Enable all items for all Mailbox for Auditing:

8. Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox

-AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Update,Move,MoveToDeletedItems

 

Set the duration of the logs to be saved for all users (example 365 days for 1 year, double for 2 years, etc):

9. Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditLogAgeLimit 365

 

Verify mailbox is set for auditing:

10. Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | FL Name,Audit*

 

Special thanks as always to: Bob Klinger | Deployment Ambassador

Microsoft Concierge – Office 365