Microsoft Office 365 Outlook Audit Events
The following list of audit events are supported for Microsoft Office 365 Outlook. For event description, refer to the Microsoft article.
Note
Netskope recommends a Microsoft Office 365 E5 or above license to get a full list of audit log events.
Friendly Name | Operation |
|---|---|
Accessed mailbox items | MailItemsAccessed |
Added delegate mailbox permissions | Add-MailboxPermission |
Added or removed user with delegate access to calendar folder | UpdateCalendarDelegation |
Added permissions to folder | AddFolderPermissions |
Copied messages to another folder | Copy |
Created mailbox item | Create |
Created new inbox rule in Outlook web app | New-InboxRule |
Deleted messages from Deleted Items folder | SoftDelete |
Labeled message as a record | ApplyRecordLabel |
Moved messages to another folder | Move |
Moved messages to Deleted Items folder | MoveToDeletedItems |
Modified folder permission | ModifyFolderPermissions |
Modified inbox rule from Outlook web app | Set-InboxRule |
Purged messages from the mailbox | HardDelete |
Removed delegate mailbox permissions | Remove-MailboxPermission |
Removed permissions from folder | RemoveFolderPermissions |
Sent message | Send |
Sent message using Send As permissions | SendAs |
Sent message using Send On Behalf permissions | SendOnBehalf |
Updated inbox rules from Outlook client | UpdateInboxRules |
Updated message | Update |
User signed in to mailbox | MailboxLogin |
Label message as a record | <not supported> |