Audit Logging in Outlook Live

A feature that I am finding not many folks know about in Outlook Live is Audit Logging.  This is a service that an administrator can use to track PowerShell commands that are either being run directly through the PowerShell client, or indirectly through the Admin UI in the Exchange Control Panel.

I recorded a short demo of some common commands that you can run.

 

Here are the commands I used in the demo:

# Turn auditing on, and direct event to my logging mailbox
Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogMailbox logging@contososchool.info

# Create a new dynamic distribution group
New-DynamicDistributionGroup -name "all contoso school" -IncludedRecipients mailboxusers

# Delete the dynamic distribution group
Remove-DynamicDistributionGroup -i allcontososchool

# Create an audit filter to only filter for the New-DynamicDistributionGroup cmdlet
Set-AdminAuditLogConfig -AdminAuditLogCmdlets New-DynamicDistributionGroup -AdminAuditLogParameters *

# Remove the audit filters
Set-AdminAuditLogConfig -AdminAuditLogCmdlets * -AdminAuditLogParameters *

# Turn auditing off
Set-AdminAuditLogConfig -AdminAuditLogEnabled $false

Happy auditing!

Jonny

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: