We have the option "Automatically update email address based on email address policy got selected automatically" unchecked on the mailboxes to have a custom email address added to the users and make it as primary.

Now we see that some how this is checked and the default address policy got forced changing the primary email id.

The check box was not selected manually neither did we run the command to enable the EmailAddressPolicyEnabled to True

What else can cause the option to get enabled. 

Thanks in advance. 

Hi ,

You can use the admin audit logs in exchange to find when and who has enabled that option .

Thank you Nithyanandham.

I have checked the Admin audit logs. Unfortunately, it does not give details about who enabled this option. Again this change was done on a majority of the users not a select few.

Hi,

The ways we can change the option are check that box manually and enable it to true via PowerShell. And Whichever method we use, this action will be logged to Administrator audit logging. So the only way we can check who change this setting is going to Administrator audit logging. Please check if you have enable Administrator audit logging by the following command:

Get-AdminAuditLogConfig | Fl

Administrator audit logging

https://technet.microsoft.com/en-us/library/dd335144(v=exchg.150).aspx

Best Regards.

Thank you Lynn.

I understand Audit logging is my best bet here. However, I have verified the audit logs for past 90 days and don't see the changes. So the option being selected via powershell did not happen.

Search-AdminAuditLog -StartDate (get-date).adddays(-90) -EndDate (get-date) -Cmdlets Set-Mailbox -Parameters EmailAddressPolicyEnabled

is what I'm using to search the audit logs

Hi,

If there are no AdminAuditlogs related to this change, then this option could be changed manually. And there is no way to check who changed option manually.

Best Regards.