Enable Auditing for Exchange On-Premise/Online

Email Auditing in Exchange On-Premise/Online (Office 365)

In Exchange, we can turn on mailbox auditing to log mailbox access by mailbox owners, delegates, and administrators. By default, mailbox auditing in Exchange is not turned on.

After we enable mailbox audit logging for a mailbox, certain actions performed by administrators and delegates will be logged by default. However, to log actions performed by the mailbox owner, we have to specify which actions of owner should be audited.

Mailbox audit logs are generated for every mailbox that has mailbox auditing is enabled.

Log entries are stored in the Recoverable Items folder in the audited mailbox, in the sub-folder named "Audits".

This ensures that all audit log entries are available from a single location, regardless of which client access method was used to access the mailbox OR which server/workstation is used by an administrator to access the audit logs.

1. Can we move and save Exchange Audit logs to another location?
If you move a mailbox to another Mailbox server, the mailbox audit logs for that mailbox are also moved because they're located in the mailbox itself.

2. Can we increase duration of Exchange Audit logs storage?
By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. You can modify this retention period by using the AuditLogAgeLimit parameter with the Set-Mailbox cmdlet.

3. Can we increase Exchange Audit logging details?
Exchange provides out of the box features for Email auditing. But for additional settings/details we can use PowerShell commands.

How to Enable Mailbox auditing in Exchange On-Premise/Online

1.     This command can be skipped for Exchange On-Premise. On your local computer, open Windows PowerShell and run the following command.

$UserCredential = Get-Credential

2.     This command can also be skipped for Exchange On-Premise. Run the following command.

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic –AllowRedirection

3.     This command can be skipped for Exchange On-Premise. Run the following command.

Import-PSSession $Session

4.     To verify that you’re connected to your Exchange Online organization, run the following command to get a list of all the mailboxes in your organization.

Get-Mailbox

5.     Enable mailbox audit logging

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

6.     Increase duration of storage of logs

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox - AuditlogAgelimit  “number of days to increase”

Example- Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditlogAgelimit  120

You can visit TechNet Article for Exchange Online (Office 365) and TechNet Article for Exchange On-Premise for more details on PowerShell Commands for Exchange Auditing.

If you have any questions you can reach out our SharePoint Consulting team here.

Enable Auditing for SharePoint Online & SharePoint 2013 On-Premise

Auditing in SharePoint Online and SharePoint 2013 On-Premise

SharePoint Online/On-Premise has built-in audit feature that enable us to track administrative activities.

With SharePoint auditing, we can monitor site collection level administration such as permission changes, role updates, group membership changes and changes to the audit policy itself.

There are few areas of SharePoint administration which can't be audited, such as; farm administrator assignments, site collection creation and other farm level operations.

For SharePoint auditing, we have to use “Audit log reports” settings from Site Collection Settings. Both, SharePoint Online (Office 365) and SharePoint On-Premise have different options for auditing settings.

Steps to configure Auditing in SharePoint:
1. Navigate to Site Settings of Root level site.
2. Click "Audit log reports" under "Site Collection Administration" section.
3. Configure the Auditing according to the requirements.

1. Following image shows audit settings that are available in SharePoint Online (Office 365).

2. Following image shows audit settings that are available in SharePoint 2013 On-Premise.

FAQs

1. Can we increase duration of storage for SharePoint audit reports?
For SharePoint auditing, it provides report based logs that can be utilize to see overall all usage of sites, documents, lists, etc.

To see audit log, first we have to select location (SharePoint list) where we want to save our audit log report.

If we are using Office 365, then storage limit is based on our storage quota for Office 365 tenant. If we are using On-Premise version, then storage quota is based on storage capacity of our server.

Storage limit is also based on list, maximum items it can handle. We can also set document retain settings after which audit report will be deleted.

2.  Can we move and save SharePoint audit logs to another location?

Audit logs are saved to list as excel file and we can download that file to check the report. We can move this audit log files as we desire and this way we can save/move logs.

3.  Can we increase SharePoint audit log details?

We cannot change logging details for auditing, but we can use audit settings where it provides some items that can be included/removed from audit log report.

If you have any questions you can reach out our SharePoint Consulting team here.