The following list of audit events are supported for Microsoft Office 365 Outlook. For event description, refer to the Microsoft article.
Note
Netskope recommends a Microsoft Office 365 E5 or above license to get a full list of audit log events.
| Friendly Name | Operation |
|---|---|
| Accessed mailbox items | MailItemsAccessed |
| Added delegate mailbox permissions | Add-MailboxPermission |
| Added or removed user with delegate access to calendar folder | UpdateCalendarDelegation |
| Added permissions to folder | AddFolderPermissions |
| Copied messages to another folder | Copy |
| Created mailbox item | Create |
| Created new inbox rule in Outlook web app | New-InboxRule |
| Deleted messages from Deleted Items folder | SoftDelete |
| Labeled message as a record | ApplyRecordLabel |
| Moved messages to another folder | Move |
| Moved messages to Deleted Items folder | MoveToDeletedItems |
| Modified folder permission | ModifyFolderPermissions |
| Modified inbox rule from Outlook web app | Set-InboxRule |
| Purged messages from the mailbox | HardDelete |
| Removed delegate mailbox permissions | Remove-MailboxPermission |
| Removed permissions from folder | RemoveFolderPermissions |
| Sent message | Send |
| Sent message using Send As permissions | SendAs |
| Sent message using Send On Behalf permissions | SendOnBehalf |
| Updated inbox rules from Outlook client | UpdateInboxRules |
| Updated message | Update |
| User signed in to mailbox | MailboxLogin |
| Label message as a record | <not supported> |