How do you use the Microsoft 365 audit log to investigate an email incident?

When a mailbox is compromised, message trace tells you what mail flowed. The audit log tells you what the attacker did: which rules they created, where they forwarded mail, what they sent and what they read. This guide covers where to search, which events matter, how long records last, and a step-by-step investigation.

What is the Microsoft 365 audit log?

Microsoft Purview Audit records user and admin activity across Microsoft 365 in one unified audit log. Microsoft says it "captures, records, and retains thousands of user and admin operations performed in dozens of Microsoft services" (Microsoft Learn). For email, two kinds of record matter:

• Mailbox audit records: actions inside a mailbox, such as sending, deleting, accessing mail and changing inbox rules.
• Exchange admin records: cmdlets that change configuration, such as Set-Mailbox. Microsoft notes that cmdlets beginning with Get-, Search- or Test- aren't recorded.

Is auditing turned on?

Both layers are on by default, but check rather than assume.

Unified audit log search is on by default for enterprise organizations. In Exchange Online PowerShell, run:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True means it's on. Microsoft warns that running this in Security & Compliance PowerShell always shows False, so use Exchange Online PowerShell (Microsoft Learn).

Mailbox audit logging "is turned on by default in all organizations" (Microsoft Learn). Microsoft says it turned this on for all Office 365 and Microsoft 365 organizations starting in January 2019 (Microsoft Learn). Check it with:

Get-OrganizationConfig | Format-List AuditDisabled

False means mailbox auditing is on. It covers user, shared and Microsoft 365 Group mailboxes.

One catch: Microsoft says mailbox audit events "return only for users with E5 licenses" in some searches. For other users it recommends running Set-Mailbox -Identity <mailbox> -AuditEnabled $true on the mailbox, and toggling it off and on if searches still return nothing (Microsoft Learn). Do this now for key mailboxes, not during an incident.

Audit (Standard) vs Audit (Premium): how long are records kept?

Sources: Microsoft Learn: auditing solutions and Microsoft Learn: search the audit log, at the time of writing (October 2026).

The 180-day Standard retention is fairly recent. Microsoft says records created before October 17, 2023 were kept for 90 days, and records from that date on are kept for 180 days.

Premium's one-year retention applies to users with Office 365 E5, Microsoft 365 E5, Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance) or the E5 eDiscovery and Audit add-on. Everyone else gets 180 days. Business email compromise is often discovered months later, when a supplier chases an unpaid invoice, so 180 days can be tight. If you might need longer, export records to your own storage or a SIEM through the Office 365 Management Activity API.

Which audit events matter for email incidents?

Names come from Microsoft's audit activities list and mailbox auditing page. By default, mailbox auditing logs Send, MailItemsAccessed, UpdateInboxRules, SoftDelete, HardDelete and several others for owners. MailboxLogin and SearchQueryInitiated aren't logged by default; you add them with Set-Mailbox -AuditOwner @{Add="MailboxLogin"}.

Inbox rules and forwarding

Rules and forwarding are how attackers hide replies and keep copying mail after a password reset. Our guide to malicious inbox rules and auto-forwarding shows how to find the rules that exist now. The audit log adds when they were made and from where.

In a New-InboxRule record, Microsoft says the ObjectId field shows the rule name, Parameters shows its conditions and actions (such as MoveToFolder), and UserId shows who created it (Microsoft Learn).

Forwarding set on the mailbox itself shows up as Set-Mailbox. In Parameters, ForwardingSmtpAddress is the destination. If DeliverToMailboxAndForward is True, a copy stays in the mailbox; if False, mail only goes to the forwarding address.

MailItemsAccessed: what did the attacker read?

MailItemsAccessed covers "all mail protocols: POP, IMAP, MAPI, EWS, Exchange ActiveSync, and REST" (Microsoft Learn). Microsoft describes it as part of Audit (Standard) and "enabled by default for users that are assigned an Office 365 E3/E5 or Microsoft 365 E3/E5 license." If your users have other plans, check with Get-Mailbox <user> | Select-Object -ExpandProperty AuditOwner.

It records two kinds of access:

• Bind: one message opened. Records list each message's InternetMessageId, with binds in a 2-minute interval grouped into one record.
• Sync: desktop Outlook downloading a folder. Microsoft says "all mail items in the synced folder are assumed to be compromised."

To separate the attacker from the real user, compare ClientIPAddress, ClientInfoString and SessionId with the attacker's sign-in. If a sync came from the attacker's context, Microsoft's advice is to assume they "synced all mail items to their client, which means the entire mailbox is compromised." That matters if the mailbox held personal, health or financial data you may have to report.

How do you search the audit log?

In the Microsoft Purview portal

You need the Audit Logs or View-Only Audit Logs role. By default the Audit Reader and Audit Manager role groups have them (Microsoft Learn).

1. Sign in to the Microsoft Purview portal and open the Audit solution.
2. Set the Date and time range (UTC). The default is the last seven days, and the maximum range is 180 days.
3. Enter operation names in Activities - operations names, for example New-InboxRule,Set-InboxRule,UpdateInboxRules,Send. Names must be exact.
4. Add the compromised account under Users.
5. Name the search and select Search. Jobs keep running after you close the browser, and completed jobs are kept for 30 days.
6. Open a result for its details, or Export to CSV.

For forwarding changes, leave activities blank, then filter the results to Set-Mailbox.

With Search-UnifiedAuditLog

The Search-UnifiedAuditLog cmdlet runs in Exchange Online PowerShell. By default it returns only 100 records; -ResultSize goes up to 5,000, and -SessionCommand ReturnLargeSet pages through up to 50,000 unsorted results (Microsoft Learn). Dates are in UTC.

Search-UnifiedAuditLog -StartDate "2026-09-01" -EndDate "2026-10-10" `
  -UserIds user@example.com `
  -Operations New-InboxRule,Set-InboxRule,UpdateInboxRules,Send,MailItemsAccessed `
  -SessionId "incident-001" -SessionCommand ReturnLargeSet -ResultSize 5000 |
  Export-Csv incident-001.csv -NoTypeInformation

Run the same command with the same SessionId until it returns nothing. The details sit in the AuditData column as JSON.

Searching by user won't show what a delegate did in that mailbox, or activity in a shared mailbox. For that, Microsoft suggests searching by the mailbox's GUID: -FreeText (Get-Mailbox <mailbox>).ExchangeGuid.

Step-by-step: investigating a compromised mailbox

Contain the account first, using the steps in signs your email account is compromised. Then:

1. Set the window. Start a few days before the first suspicious sign-in or phishing click, and end now.
2. Find the attacker's IP addresses. Search the user's activity and note IP addresses and clients that don't match the user's normal pattern.
3. Search rule and forwarding changes (New-InboxRule, Set-InboxRule, UpdateInboxRules, Set-Mailbox, Add-MailboxPermission). Record each rule's name and actions, and each forwarding address.
4. Search Send records from the attacker's IPs and sessions to list what they sent, and to whom. Cross-check with message trace.
5. Search MailItemsAccessed for the same context to scope what they read or synced.
6. Search across the tenant for the attacker's IP addresses (-IPAddresses) and rule names, because attackers often reuse them.
7. Export everything to CSV and keep it with your incident notes, especially if retention is 180 days.

Audit records are typically available 60 to 90 minutes after an event, and Microsoft doesn't guarantee a time (Microsoft Learn). Re-run searches later before concluding that nothing happened.

If you have Defender for Office 365 Plan 2, automated investigation and response also flags forwarding and delegation it finds, and Threat Explorer can remove the phish that started it.

Next steps

1. Today, confirm UnifiedAuditLogIngestionEnabled is True and AuditDisabled is False.
2. Check that MailItemsAccessed and Send are in AuditOwner for your key mailboxes, and set AuditEnabled on non-E5 mailboxes.
3. Give one or two named people the View-Only Audit Logs role before an incident.
4. Decide whether 180 days is enough, or export audit data somewhere you control.
5. Reduce how often you need this guide. Most mailbox compromises start with a phishing email; iBlockSpam filters phishing and spoofing at the MX. See how it works.

Browse our other email operations guides.