Microsoft Office 365 Outlook Audit Events

Microsoft Office 365 Outlook Audit Events

The following list of audit events are supported for Microsoft Office 365 Outlook. For event description, refer to the Microsoft article.


Netskope recommends a Microsoft Office 365 E5 or above license to get a full list of audit log events.

Friendly NameOperation
Accessed mailbox itemsMailItemsAccessed
Added delegate mailbox permissionsAdd-MailboxPermission
Added or removed user with delegate access to calendar folderUpdateCalendarDelegation
Added permissions to folderAddFolderPermissions
Copied messages to another folderCopy
Created mailbox itemCreate
Created new inbox rule in Outlook web appNew-InboxRule
Deleted messages from Deleted Items folderSoftDelete
Labeled message as a recordApplyRecordLabel
Moved messages to another folderMove
Moved messages to Deleted Items folderMoveToDeletedItems
Modified folder permissionModifyFolderPermissions
Modified inbox rule from Outlook web appSet-InboxRule
Purged messages from the mailboxHardDelete
Removed delegate mailbox permissionsRemove-MailboxPermission
Removed permissions from folderRemoveFolderPermissions
Sent messageSend
Sent message using Send As permissionsSendAs
Sent message using Send On Behalf permissionsSendOnBehalf
Updated inbox rules from Outlook clientUpdateInboxRules
Updated messageUpdate
User signed in to mailboxMailboxLogin
Label message as a record<not supported>
Share this Doc
In this topic ...