Audit Logging in Outlook Live

A feature that I am finding not many folks know about in Outlook Live is Audit Logging.  This is a service that an administrator can use to track PowerShell commands that are either being run directly through the PowerShell client, or indirectly through the Admin UI in the Exchange Control Panel.

I recorded a short demo of some common commands that you can run.


Here are the commands I used in the demo:

# Turn auditing on, and direct event to my logging mailbox
Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogMailbox

# Create a new dynamic distribution group
New-DynamicDistributionGroup -name "all contoso school" -IncludedRecipients mailboxusers

# Delete the dynamic distribution group
Remove-DynamicDistributionGroup -i allcontososchool

# Create an audit filter to only filter for the New-DynamicDistributionGroup cmdlet
Set-AdminAuditLogConfig -AdminAuditLogCmdlets New-DynamicDistributionGroup -AdminAuditLogParameters *

# Remove the audit filters
Set-AdminAuditLogConfig -AdminAuditLogCmdlets * -AdminAuditLogParameters *

# Turn auditing off
Set-AdminAuditLogConfig -AdminAuditLogEnabled $false

Happy auditing!



Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: