Shulou(Shulou.com)06/02 Report--

Audit logs have been enabled for Exchange Online in Office 365 in the enterprise, and actions that need to be audited have been configured. When in normal operation, the audit log of the mailbox is retained by default for 90 days. Now all actions that meet the audit criteria will be recorded in the log. For example, the mailbox operation of the user accessed by the administrator, and the mail in the user's mailbox has been deleted by a delegated user. Each log contains information such as the time of access, the user visited, the action performed, and whether the operation was successful or not.

The contents of the mailbox audit log can be obtained by using Exchange Central Administration (EAC). However, because the mailbox audit log for Exchange Online is provided in XML format and is sent as an attachment to the designated receiving mailbox. By default, Exchange Online's Outlook Web App (OWA) does not support XML attachments, so if you use OWA as a client, you need an additional configuration to enable allow XML attachments.

Configure OWA to allow XML attachments

By default, Exchange Online's OWA only allows mail attachments with the following extension:

The extensions explicitly marked as blocked are:

1. How to understand the attachment format supported or rejected by Exchange Online OWA by default

You can obtain all attachment file extension formats supported or rejected by the current Exchange Online OWA through the Get-OwaMailboxPolicy command

Get-OwaMailboxPolicy | Select-Object-ExpandProperty AllowedFileTypes

Get-OwaMailboxPolicy | Select-Object-ExpandProperty BlockedFileTypes

2. Add OWA to support XML attachment format files

Use Set-OwaMailboxPolicy to set the OWA mailbox policy and add the XML format extension to the OWA allow list of Exchange Online.

Set-OwaMailboxPolicy-Identity OwaMailboxPolicy-Default-AllowedFileTypes @ {add='.xml'}

Looking at the results through Get-OwaMailboxPolicy, you can see that xml is already in the allow list.

If support is no longer needed, it can be removed from the allow list.

Set-OwaMailboxPolicy-Identity OwaMailboxPolicy-Default-AllowedFileTypes @ {remove='.xml'}

3. Make sure that XML is not in the list of files in OWA blocking attachment format.

You can also use Set-OwaMailboxPolicy to set the OWA mailbox policy to remove the extension of the specified format from the OWA block list of Exchange Online.

Set-OwaMailboxPolicy-Identity OwaMailboxPolicy-Default-BlockedFileTypes @ {remove='.xml'}

Of course, if you need to block a file in a specific format, you can simply use add to add it to the block list.

2. Export mailbox audit log

In the Exchange Management Center (EAC), click Compliance Management in the left navigation bar, click Audit in the right window, and then click Export Mailbox Audit Log.

In the pop-up "Export Mailbox Audit Log" page, you need to set the following parameters:

The start and end times of the log, specifying which user's mailbox audit log or all mailbox audit logs need to be exported.

By default, the "all non-owner" access log is searched, and other types can be selected.

All non-owners: will include access for administrators and delegated users within the organization, as well as for administrators of Microsoft data centers running Exchange Online

External users: includes access only to administrators of Microsoft data centers running Exchange Online

Administrators and delegated users: includes access only to administrators and delegated users within the organization

Administrator: includes only the access of administrators within the organization.

Finally, specify the mailbox that receives the audit log, and click Export to complete the configuration.

It is important to note that the process of receiving the email is slow, and the prompt in EAC "will be sent within 24 hours" to the specified recipient.

Third, how to analyze mailbox audit log

When Exchange Online performs an audit log export, the designated receiving mailbox will receive an email in the following format:

The attachment contains a SearchResult.xml file. In this xml file, each event appears in the form of an entry, with an entry as "

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.