In this blog post, I’ll show you how to enable auditing on an Exchange Online shared mailbox and how to see who has accessed it.
Shared mailboxes are useful resources but are not audited by default. To enable auditing, you need to use PowerShell. The first step is to authenticate to your Exchange Online tenant using an account that has permission to change audit settings, like an Office 365 Global Administrator account.
Audit Shared Mailbox Access Using PowerShell
Step 1. Connect to Exchange Online
The code below gets the user credential and then creates a session using Import-PSSession. If you want to use multifactor authentication to connect to Exchange Online, you’ll need to use the Exchange Online Remote PowerShell Module, which can be downloaded from the Exchange Admin Center.
Set-ExecutionPolicy RemoteSigned$UserCredential = Get-Credential$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirectionImport-PSSession $SessionStep 2. Enable Auditing
Once you’ve connected to Exchange Online, use the Set-Mailbox cmdlet to enable auditing on a mailbox. The command below enables auditing on a mailbox called SharedMail.
Set-Mailbox –Identity SharedMail -AuditEnabled $TrueAlternatively, you can enable auditing on all mailboxes using Get-Mailbox and Set-Mailbox together:
$Mailboxes = Get-Mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')} $Mailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $True}You can verify that you enabled auditing on the selected mailboxes by using the Get-Mailbox cmdlet:
Get-Mailbox | Format-List Name,AuditEnabledOnce you’ve finished running PowerShell commands, use Remote-PSSession to disconnect from Exchange Online.
Remove-PSSession $SessionStep 3. Run a Mailbox Access Report in the Exchange Admin Center
Now that auditing is enabled, you can run a report in the Exchange Admin Center to list who is accessing audited mailboxes.
- Log in to the Exchange Admin Center (EAC) here.
- On the left of EAC, click compliance management.
- Click auditing.
- Click Run a non-owner mailbox access report.
- Set the search criteria in the ‘search for mailboxes accessed by non-owners’ dialog window, like start and end date.
- Click search to run the report.
Audit Shared Mailbox Access with Lepide Office 365 Auditor
If you need an easier way to detect shared mailbox access in Exchange Online or audit Office 365 in general, come and take a look at Lepide Office 365 Auditor. It will help to overcome the limitations of the above native method by automating much of the process and allowing you to continuously audit and monitor changes. Lepide Auditor can track mailbox access by owners and non-owners and shared mailbox access
