Missing Update Operations in Shared Mailbox Audit Logs

Question

Issue: I have enabled audit logging for a shared mailbox in Exchange Online. The audit settings are configured to log various operations, including Update. However, I am not seeing any Update operations in the audit logs, even though I am certain that such operations have been performed since mails have been marked as read, flagged etc..

Current Audit Settings:

• AuditEnabled: True
• AuditAdmin: {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
• AuditDelegate: {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
• AuditOwner: {Update, MoveToDeletedItems, SoftDelete, HardDelete...}

Steps Taken:

1. Verified that audit logging is enabled for the shared mailbox.
2. Checked the audit settings to ensure Update is included.
3. Searched the audit logs using the following PowerShell command:

      Search-MailboxAuditLog -Identity "SharedMailboxName" -LogonTypes Admin, Delegate, Owner -Operations Update -StartDate "StartDate" -EndDate "EndDate" -ShowDetails
   

Audit seems to be working overall, I can view operations like Create, SendAs and SoftDelete but Update is the one that I need.

Answer 1

There is the possibility that the mailbox is excluded from auditing, which you can check via the *Get-MailboxAuditBypassAssociation *cmdlet. Other than that, I see nothing wrong in the above, and the cmdlet should produce some results. That said, I'm not sure that "marked as read" is actually classified as Update operation, to cover those you should look at MailItemsAccessed records.