PowerShell » Search-MailboxAuditLog

Get-Mailbox Activity Exchange Using PowerShell

Your download is in progress and it will be complete in just a few seconds! If you face any issues, download manually here
Stay informed about Exchange with
Exchange Reporter Plus
  • Please enter business email address
    By clicking 'Proceed to Download', you agree to processing of personal data according to the Privacy Policy. You can unsubscribe from our mails at anytime.

Exchange Online Reports

Cmdlet: Search-MailboxAuditLog

Description: This cmdlet searches the mailbox audit logs for one or more mailboxes and displays search results in the Exchange Management Shell window.

  1.  Search-MailboxAuditLog
  2.   [[-Identity] <MailboxIdParameter>]
  3.   [-ShowDetails]
  4.   [-DomainController <Fqdn>]
  5.   [-EndDate <ExDateTime>]
  6.   [-ExternalAccess <Boolean>]
  7.   [-GroupMailbox]
  8.   [-HasAttachments <Boolean>]
  9.   [-IncludeInactiveMailbox]
  10.   [-LogonTypes <MultiValuedProperty>]
  11.   [-Operations <MultiValuedProperty>]
  12.   [-ResultSize <Int32>]
  13.   [-StartDate <ExDateTime>]
  14.   [<CommonParameters>]

To search mailbox audit logs for multiple mailboxes and have the results sent by email to specified recipients, use the New-MailboxAuditLogSearch cmdlet instead.

Example 1:

1  Search-MailboxAuditLog -Identity Jdoe -LogonTypes Admin,Delegate -StartDate 1/1/2020 -EndDate 12/31/2020 -ResultSize 2000

This script retrieves the mailbox audit log entries for actions performed by Admin and Delegate logon types on John Doe's mailbox between 1/1/2020 and 12/31/2020. A maximum of 2,000 log entries will be returned.

You need to be assigned permissions before you can run this cmdlet. Although this report lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you.

Get Exchange mailbox activities report with Exchange Reporter Plus

While using PowerShell scripts, based on the granularity and size of the data to be fetched, the complexity and the time take to return the results vary respectively. Try Exchange Reporter Plus to generate more than 200 predefined reports on Exchange Servers in a single click.


Some of the Exchange admin activities reports provided by Exchange Reporter Plus include,

  • Admin Activity on Mailbox.
  • Delegate Activity on Mailbox.
  • Non Owner Activity on Mailbox.
  • Owner Activity on Mailbox.
  • Mailbox Permission Changes.
  • Mailbox Storage Quota Changes, and more.

Advantages of using Exchange Reporter Plus

    • Reports scheduler:  Reports can be scheduled to be generated at regular intervals to reduce the overhead of generating reports manually.
    • Report export: The reports can be exported to PDF, XLS, HTML, or CSV formats and emailed to the administrator.
    • Advanced filters: Use attribute-based filters to get the data you need without lengthy PowerShell scripts.
    • Secure delegation: Securely delegate the task of report generation to technicians and IT staff without giving them admin access.

Read more about the Exchange Reporter Plus, here.

A single pane of glass for Exchange Server Monitoring, Reporting and Auditing