Microsoft Office 365 Outlook Audit Events
Microsoft Office 365 Outlook Audit Events
The following list of audit events are supported for Microsoft Office 365 Outlook. For event description, refer to the Microsoft article.
Note
Netskope recommends a Microsoft Office 365 E5 or above license to get a full list of audit log events.
| Friendly Name | Operation |
|---|---|
| Accessed mailbox items | MailItemsAccessed |
| Added delegate mailbox permissions | Add-MailboxPermission |
| Added or removed user with delegate access to calendar folder | UpdateCalendarDelegation |
| Added permissions to folder | AddFolderPermissions |
| Copied messages to another folder | Copy |
| Created mailbox item | Create |
| Created new inbox rule in Outlook web app | New-InboxRule |
| Deleted messages from Deleted Items folder | SoftDelete |
| Labeled message as a record | ApplyRecordLabel |
| Moved messages to another folder | Move |
| Moved messages to Deleted Items folder | MoveToDeletedItems |
| Modified folder permission | ModifyFolderPermissions |
| Modified inbox rule from Outlook web app | Set-InboxRule |
| Purged messages from the mailbox | HardDelete |
| Removed delegate mailbox permissions | Remove-MailboxPermission |
| Removed permissions from folder | RemoveFolderPermissions |
| Sent message | Send |
| Sent message using Send As permissions | SendAs |
| Sent message using Send On Behalf permissions | SendOnBehalf |
| Updated inbox rules from Outlook client | UpdateInboxRules |
| Updated message | Update |
| User signed in to mailbox | MailboxLogin |
| Label message as a record | <not supported> |
