Office 365: Turn on Mailbox Auditing

You can log mailbox access by mailbox owners, delegates and administrators in Office 365 but it's not enabled by default. Once enabled you will be able to track down events such as inadvertently deleted mail by users. Another reason to turn on logging is so that users can be re-assured that admins aren't reading user mail without permission, because all mailbox access is logged.

To turn on mailbox auditing, a Global Admin must do the following:

1. Log in at http://portal.office.com/
2. Go to Admin > Admin centres > Security & Compliance.
3. Go to Search & investigation > Audit log search.
4. Click Start recording user and admin activity on the Audit log search page. If the option doesn’t appear then auditing has already been enabled.
5. It will take a couple of hours before you can start running searches on the audit log.

The user that you would like to search the audit log needs to be assigned the correct permissions:

1. Log in at http://portal.office.com/
2. Go to Admin > Admin centres > Exchange.
3. Go to permissions > admin roles.
4. Select Compliance Management and click the edit pencil at the top.
5. Under Members add in the required user.
6. Click Save.