Enable mailbox auditing in Office 365
https://technet.microsoft.com/en-us/library/dn879651.aspx
Step 1: Install required software
These steps are required once on your computer, not every time you connect. However, you’ll likely need to install newer versions of the software periodically.
1.Install the 64-bit version of the Microsoft Online Services Sign-in Assistant: Microsoft Online Services Sign-in Assistant for IT Professionals RTW.
https://go.microsoft.com/fwlink/p/?LinkId=286152
2.Install the 64-bit version of the Windows Azure Active Directory Module for Windows PowerShell with these steps:
Open the Azure Active Directory Connection web page.
In Files in Download at the bottom of the page, click Download for the AdministrationConfig-V1.1.166.0-GA.msi file, and then install it.
http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185
Login to Office 365 using Windows Azure Active Directory for Windows Powershell (Right click and run as Administrator)
- Set-ExecutionPolicy RemoteSigned
- Import-Module MSOnline
- $O365Cred = Get-Credential
- $O365Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential $O365Cred -Authentication Basic -AllowRedirection
- Import-PSSession $O365Session
- Connect-MsolService –Credential $O365Cred
Enable all Mailboxes for Auditing to True:
- Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditEnabled $true
Enable all items for all Mailbox for Auditing:
- Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox
-AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Update,Move,MoveToDeletedItems
Set the duration of the logs to be saved for all users (example 365 days for 1 year, double for 2 years, etc):
- Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditLogAgeLimit 365
Verify mailbox is set for auditing:
- Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq “UserMailbox”} | FL Name,Audit*
Special thanks as always to: Bob Klinger | Deployment Ambassador
Microsoft Concierge – Office 365