Shulou(Shulou.com)06/02 Report--

In cases where administrators in the enterprise have been able to monitor and track. Many Office 365users and enterprises are very concerned about whether Microsoft Office 365administrators will make sudden changes to the configuration of the Exchange Online they use, or how Microsoft administrators can track them after making changes to Exchange Online.

An audit mechanism called external administrator is provided in the Exchange Online of Office 365. the function of this audit mechanism is to audit the configuration operation of Microsoft Office 365system administrator or Microsoft authorized partner Office 365system administrator in Exchange Online.

Like the administrator audit log, the external administrator audit log can be obtained in two ways: directly retrieving and viewing the log and exporting the log to a XML file.

1. Retrieve and view external administrator audit log

Retrieving and viewing external administrator audit logs can be done through both Exchange Management Center (EAC) and PowerShell.

1. Use EAC to retrieve and view external administrator audit logs

Navigate to Compliance Management in EAC, select Audit on the right, and click run external Administrator Audit Log report.

In the search for external administrator configuration changes window, specify the start and end dates of the logs to retrieve, and if not defined, nearly 15 days of logs are filtered by default. Click "search" to search, and the results will be displayed below.

2. Use PowerShell to retrieve external administrator audit log

The administrator audit log can be retrieved using the Search-AdminAuditLog command in PowerShell, and if the ExternalAccess parameter is added when running the command, the actions performed by the Microsoft Office system (data center) administrator and delegated administrator will be retrieved.

Search-AdminAuditLog-ExternalAccess $true

You can also specify conditions to filter the results of retrieval, such as retrieving logs within a specified time range.

Search-AdminAuditLog-ExternalAccess $true-StartDate 03Universe 06Universe 2019-EndDate 03Universe 07Universe 2019

Second, export external administrator audit log

Like exporting the administrator audit log, you can export the external administrator audit log through PowerShell, but you cannot export the external administrator audit log through EAC for the time being.

Use the New-AdminAuditLogSearch join ExternalAccess parameter to export an external administrator audit log with the same syntax as exporting an administrator audit log.

New-AdminAuditLogSearch-ExternalAccess $true-StartDate 03ax 06External admin audit 2019-EndDate 03Unique 2019-StatusMailRecipients admin@lpwr.net-Name "External admin audit 20190308"

Similarly, after the execution of this operation, Exchange Online will send the log entries that meet the filter criteria to the specified mailbox as an XML file attachment, which is also within 24 hours. So it takes a long time to wait, and the size of the XML file is limited to 10MB.

If you need to view existing log export tasks, you can do so through Get-AuditLogSearch.

Get-AuditLogSearch | Format-List

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.