The value of Confirm is not included in the CmdletParameters property. The value of Confirm in the CmdletParameters property indicates that unified audit logging was turned on in the compliance center or by running the Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true cmdlet. The following screenshots show audit records that correspond to changing the auditing status in your organization. To search the Exchange admin audit log for audit records that are generated when turning auditing on or off, run the following command in Exchange Online PowerShell: Search-AdminAuditLog -Cmdlets Set-AdminAuditLogConfig -Parameters UnifiedAuditLogIngestionEnabledĪudit records for these events contain information about when the auditing status was changed, the admin who changed it, and the IP address of the computer that was used to make the change. You can search the Exchange admin audit log for these audit records. This means that audit records are logged when auditing is turned on or turned off. Go to the Audit page in the Microsoft 365 compliance center.Īudit records when auditing status is changedĬhanges to the auditing status in your organization are themselves audited. The value of False for the UnifiedAuditLogIngestionEnabled property indicates that auditing is turned off. In Exchange Online PowerShell, run the following command: Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $falseĪfter a while, verify that auditing is turned off (disabled). Run the following PowerShell command to turn off auditing. You have to use Exchange Online PowerShell to turn off auditing. Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $trueĪ message is displayed saying that it may take up to 60 minutes for the change to take effect. Run the following PowerShell command to turn on auditing. It may take up to 60 minutes for the change to take effect. If auditing is not turned on for your organization, a banner is displayed prompting you start recording user and admin activity.Ĭlick the Start recording user and admin activity banner. In the left navigation pane of the Microsoft 365 compliance center, click Audit. Use the compliance center to turn on auditing It may take several hours after you turn on auditing before you can return results when you search the audit log. If auditing is not turned on for your organization, you can turn it on in the Microsoft 365 compliance center or by using Exchange Online PowerShell.
A value of False indicates that auditing is not turned on. To verify that auditing is turned on for your organization, you can run the following command in Exchange Online PowerShell: Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabledĪ value of True for the UnifiedAuditLogIngestionEnabled property indicates that auditing is turned on.
Verify the auditing status for your organization For more information about the Microsoft 365 Management Activity API, see Get started with Microsoft 365 Management APIs. This is because the underlying cmdlet is an Exchange Online PowerShell cmdlet.įor step-by-step instructions on searching the audit log, see Search the audit log. If you assign users the Audit Logs role on the Permissions page in the Microsoft 365 compliance center, they won't be able to turn auditing on or off.
Users have to be assigned permissions in Exchange Online to turn auditing on or off.
0 kommentar(er)
