We are looking to capture Owner mailbox auditing events using the native Exchange 2013 auditing tools (Search-MailboxAuditLog). I have auditing enabled with all actions for Owner, and capture items performed via Outlook, except for new emails created. If I create new emails via OWA, I am able to capture the event, but as soon as I go back to Outlook and create a new message, I dont see anything audited. I also tried this is our Dev environment and seeing the same behavior. Has anyone else experience this behavior?

First thing that comes to mind: are you using Exchange Online mode or Cached mode? Would auditing treat something done in a cached mailbox first, and then synced later, differently? Not sure myself, just an idea.

Great thought! I went back and checked the audit logs from a few days ago and its not showing any emails I sent from Outlook.

Hi,

I have a test in my environment. If I create a message on Outlook, when using the Search-MailboxAuditLog cmdlet to search the audit log, it will be displayed as follows:

The operation is "SendAs", not "Create".

Hope this can be helpful to you.

Best regards,

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi,

I have a test in my environment. If I create a message on Outlook as a owner, the mailbox audit logging can't record it.

If I create a message on Outlook as a delegate, when using the Search-MailboxAuditLog cmdlet to search the audit log, it will be displayed as follows:

The operation is "SendAs", not "Create".

Hope this can be helpful to you.

Best regards,

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.c

Thanks for the info Amy, but I am not seeing this behavior. I have all actions enabled for Owner, Admin, and Delegate and just exported the logs again, for emails that I created last week. I was able to find my OWA test emails, but nothing from Outlook. Also, it appears your LogonType is showing Delegate and not Owner. Do you know why that is?

Lastly, do you know what version of Exchange and Outlook you are running?

Hi,

I have done some more tests. Exchange 2013 with Outlook 2013, it doesn't display the result when owner creates a message. Exchange 2010 with Outlook 2010, it will display the above result I provided.

Best regards,

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Hi,

I have done some more tests. Exchange 2013 with Outlook 2013, it doesn't display the result when owner creates a message. Exchange 2010 with Outlook 2010, also the same result. When owner create a message via OWA, the mailbox audit logging will record it.

Best regards,

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.c

Thanks for the info Amy. I am using Outlook 2010 with Exchange 2013 and have the issues, so I am thinking this is possibly a bug in Exchange 2013.

Hi

I am currently looking into this issue with my colleagues. And the above behavior hasn't been confirmed as a known issue.

Best regards,

If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Thanks for the update Amy, I appreciate you looking into this further.