Goto Microsoft 365 Admin Center --> Security & Compliance --> Audit log search --> Under Activities select Moved messages to Deleted Items folder & Deleted messages from Deleted folder ( both will applicable, if the user deleted mails from Deleted folder purposely ) under Exchange mailbox activities.
PowerShell and Office 365, two of my favorite tastes, all rolled up into one. This particular blog post is not groundbreaking, but it’s fun. I’ve recently set up a few Office 365 tenants, and part of that is adding one or more custom domains. Of course you can use the Office 365 Admin Portal to do that, and there’s no shame in that. (Well ...
Auditing is another commonly discussed problem in Office 365 security circles. Mailbox auditing was disabled by default prior to January 2019, meaning organizations trying to investigate potential ...
I have turned on auditing on an Office 365 shared mailbox, but when I do a search at the audit logs I get zero results. I've expanded from the standard auditing and added the parameters "harddelete, softdelete, movetodeleteditems", etc. I put those parameters under all 3 catagories: auditadmin, auditdelegate, and auditowner.