audit logs

Question

Hi All,

I have a user in Exchange Online whose sent emails from the last one month (i.e., the sent items) are missing from users mailbox. The emails are not present in the Deleted Items or the Recoverable Items folder. Will the following syntax help me fetch the audit logs?

$date=((get-date).AddDays(-30)).ToShortDateString()
$Today=(get-date).ToShortDateString()  
Search-MailboxAuditLog user1@contoso.com -LogonTypes Admin,Owner,Delegate -ShowDetails -StartDate $date -EndDate $Today | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding UTF8

If i need to export last 30 days sent emails to a pst how can i export please guide me.

Answer 1

Hi,@Glenn Maxwell

Thanks for posting your question in the Microsoft Q&A forum.Based on your description, I don't think you have a problem providing multiple commands. Here is my test:

Export a CSV file, which is encoded in UTF8.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

If i need to export last 30 days sent emails to a pst how can i export please guide me.

Answer 3

You can use your PowerShell script with minor tweaks to search for mailbox audit logs that capture the send actions of the user. Make sure that mailbox audit logging is enabled. Use the Microsoft Purview Compliance Center or Content Search in Exchange Online to search for the sent emails in the last 30 days and export them to a PST file.

Let me know if you need more specific details on any of these steps!