Change Auditor 7.1.1 - Office 365 and Azure Active Directory Event Reference Guide


	IMPORTANT: When expecting large numbers of events, you may need to increase the Max Events per Connection setting (Agent Configuration on the Administration Tasks tab) to avoid an ever-increasing backlog of events waiting to be sent from the agent to the coordinator database.


	NOTE: To view a complete list of events, open the Audit Events page on the Administration Tasks tab. This page displays the facility to which the event belongs, the severity assigned to each event, if the event is enabled or disabled, and the type of required license.

Table 1. Office 365 Exchange Online Administration events
Event	Description	Severity
Office 365 Exchange Online administrative cmdlet executed	Created when an administrator runs a remote PowerShell command on an object in the Exchange Online mailbox. This can occur as a result of a remote PowerShell connection to the mailbox, or indirectly as a result of an action in the web administration portal for the Office 365 Exchange Online organization.	Medium
Office 365 Exchange Online administrative cmdlet executed by external user	Created when an external user (for example, a Microsoft datacenter personnel or a datacenter service account) runs a remote PowerShell command on an object in the Exchange Online mailbox.	Low

Office 365 Exchange Online Mailbox


	NOTE: Inbox rule events are only seen in Change Auditor when they are generated in Outlook. NOTE: Calendar delegation events are only seen in Change Auditor when they are generated through an OWA client.

Table 2. Office 365 Exchange Online Mailbox events
Event	Description	Severity
Calendar delegation added to online mailbox by owner	Created when calendar delegation is added to an online mailbox by the owner. (Disabled by default.)	Low
Calendar delegation removed from online mailbox by owner	Created when calendar delegation is removed from an online mailbox by the owner. (Disabled by default.)	Low
Folder moved in online mailbox by non-owner	Created when a folder was moved in an online mailbox by a user other than the owner.	Medium
Folder moved in online mailbox by owner	Created when a folder was moved in an online mailbox by the owner. (Disabled by default.)	Low
Folder moved in online shared mailbox	Created when a folder was moved in an online shared mailbox.	Medium
Folder moved to Deleted Items in online mailbox by owner	Created when a folder was moved to the Deleted Items folder in an online mailbox by the owner. (Disabled by default.)	Low
Folder moved to Deleted Items in online shared mailbox	Created when a folder was moved to the Deleted Items folder in an online shared mailbox.	Medium
Folder moved to Deleted Items in online mailbox by non-owner	Created when a folder was moved to the Deleted Items folder in an online mailbox by a user other than the owner.	Medium
Folder opened in online mailbox by non-owner	Created when a folder is opened in a user’s mailbox by a user other than the owner.	Medium
Folder opened in online mailbox by owner	Created when a folder is opened in a user’s mailbox by its owner.	Low
Folder opened in online shared mailbox	Created when a folder is opened in an online shared mailbox.	Medium
Folder opened in online mailbox by owner	Created when a folder is opened in an online mailbox by owner. (Disabled by default.)	Low
Folder permissions added in online mailbox by owner	Created when folder permissions are added to an online mailbox by owner. (Disabled by default.)	Low
Folder permissions added in online mailbox by non-owner	Created when folder permissions are added to an online mailbox by a user other than the owner.	Medium
Folder permissions added in online shared mailbox	Created when folder permissions are added to an online shared mailbox by a user other than the owner.	Medium
Folder permissions modified in online mailbox by owner	Created when folder permissions are modified in an online mailbox by owner. (Disabled by default.)	Low
Folder permissions modified in online mailbox by non-owner	Created when folder permissions are modified in an online mailbox by a user other than the owner.	Medium
Folder permissions modified in online shared mailbox	Created when folder permissions are modified in an online shared mailbox by a user other than the owner.	Medium
Folder permissions removed in online mailbox by owner	Created when folder permissions are removed from an online mailbox by owner. (Disabled by default.)	Low
Folder permissions removed in online mailbox by non-owner	Created when folder permissions are removed from an online mailbox by a user other than the owner.	Medium
Folder permissions removed in online shared mailbox	Created when folder permissions are removed in an online shared mailbox by a user other than the owner.	Medium
Folder synchronized from online mailbox by owner.	Created when emails are synchronized in an online mailbox by the owner. (Disabled by default.) NOTE: A Microsoft 365 E5 license is required to audit this activity.	Low
Folder synchronized from online mailbox by non-owner.	Created when emails are synchronized in an online mailbox by a user other than the owner. NOTE: A Microsoft 365 E5 license is required to audit this activity.	Medium
Folder synchronized from online shared mailbox	Created when a emails are synchronized from a shared mailbox. (Disabled by default.) NOTE: A Microsoft 365 E5 license is required to audit this activity.	Medium
Inbox rule added to online mailbox by owner	Created when inbox rules are added in an online mailbox by owner. (Disabled by default.)	Low
Inbox rule added to online mailbox by non-owner	Created when inbox rules are added in an online mailbox by a user other than the owner.	Medium
Inbox rule added in online shared mailbox	Created when inbox rules are added in an online shared mailbox.	Medium
Inbox rule modified in online mailbox by owner	Created when inbox rules are updated in an online mailbox by owner. (Disabled by default.)	Low
Inbox rule modified in online mailbox by non-owner	Created when inbox rules are updated in an online mailbox by a user other than the owner.	Medium
Inbox rule modified in online shared mailbox	Created when inbox rules are updated in an online shared mailbox.	Medium
Inbox rule removed from online mailbox by owner	Created when inbox rules are removed from an online mailbox by owner. (Disabled by default.)	Low
Inbox rule removed from online mailbox by non owner	Created when inbox rules are removed from an online mailbox by a user other than the owner.	Medium
Inbox rule removed from online shared mailbox	Created when inbox rules are removed from an online shared mailbox.	Medium
Online mailbox auditing has been throttled	Created when Microsoft throttles the mailbox after 1000 mail items have been accessed. Message opened events will not be recorded for 24 hours. NOTE: A Microsoft 365 E5 license is required to audit this activity.	Medium
Message copied in online mailbox by non-owner	Created when a message is copied from one folder to another in a user’s online mailbox by a user other than the owner.	Medium
Message copied in online shared mailbox	Created when a message is copied from one folder to another in an online shared mailbox.	Medium
Message created in online mailbox folder by non-owner	Created when a new message is created in a user’s mailbox by a user other than the owner.	Medium
Message created in online shared mailbox	Created when a new message is created in an online shared mailbox by a user other than the owner.	Medium
Message created in online mailbox by owner	Created when a message was created in a folder in an online mailbox by the mailbox owner. (Disabled by default.)	Low
Message hard-deleted in an online mailbox by non-owner	Created when a message is purged from a user’s Deleted Items list by a user other than the owner.	Medium
Message hard-deleted in online mailbox by owner	Created when a message was hard-deleted from an online mailbox by the mailbox owner. (Disabled by default.)	Low
Message hard-deleted in online shared mailbox	Created when a message is purged from an online shared mailbox.	Medium
Message moved in online mailbox by non-owner	Created when a message is moved from one folder to another in a user’s mailbox by a user other than the owner.	Medium
Message moved in online mailbox by owner	Created when a message was moved in an online mailbox by the mailbox owner. (Disabled by default.)	Low
Message moved in online shared mailbox	Created when a message is moved from one folder to another in an online shared mailbox.	Medium
Message moved to Deleted Items in online mailbox by non-owner	Created when a message is moved to the Deleted Items folder in a user’s online mailbox by a user other than the owner.	Medium
Message moved to Deleted Items in online shared mailbox	Created when a message is moved to the Deleted Items folder in an online shared mailbox.	Medium
Message moved to Deleted Items in online mailbox by owner	Created when a message was moved to the Deleted Items folder in an online mailbox by the mailbox owner. (Disabled by default.)	Low
Message opened in online mailbox by non-owner	Created when a message was opened in a folder in an online mailbox by a user other than the owner. NOTE: A Microsoft 365 E5 license is required to audit this activity.	Medium
Message opened in online mailbox by owner	Created when a message was opened in a folder in an online mailbox by its owner. (Disabled by default.) NOTE: A Microsoft 365 E5 license is required to audit this activity.	Low
Message opened in online shared mailbox	Created when a message was opened in a folder in an online shared mailbox. (Disabled by default.) NOTE: A Microsoft 365 E5 license is required to audit this activity.	Medium
Message sent as another user in online mailbox by owner	Created when a user sends a message as another user from their own online mailbox. (Disabled by default.)	Medium
Message sent as another user in online shared mailbox	Created when a user sends a message as another user from an online shared mailbox.	Medium
Message sent as another user in online mailbox by non-owner	Created when a user other than the owner sends a message as another user from an online mailbox.	Medium
Message sent on behalf of another user in online mailbox by owner	Created when a user sends a message on behalf of another user from their own online mailbox. (Disabled by default.)	Medium
Message sent on behalf of another user in online mailbox by non-owner	Created when a user other than the owner sends a message on behalf of another user from an online mailbox.	Medium
Message sent on behalf of another user in online shared mailbox	Created when a user sends a message as another user from an online shared mailbox.	Medium
Message soft-deleted in online mailbox by non-owner	Created when a message is deleted from an online mailbox using the Outlook shift-delete function by non-owner.	Medium
Message soft-deleted in online mailbox by owner	Created when a message is deleted from a user’s online mailbox using the Outlook shift-delete function. (Disabled by default.)	Low
Message soft-deleted in online shared mailbox	Created when a message is deleted from an online shared mailbox using the Outlook shift-delete function.	Medium
Message updated in online mailbox by non-owner	Created when certain message properties were changed in a user’s mailbox by a user other than the owner.	Medium
Message updated in online mailbox by owner	Created when message updated in online mailbox by owner. (Disabled by default.)	Low
Message updated in online shared mailbox	Created when certain message properties were changed in online shared mailbox.	Medium
Online Mailbox login by owner	Created when a mailbox owner logs in to an online mailbox.	Low
Office 365 Exchange Online Mailbox event	Generic Exchange Online Mailbox event with a dynamically constructed event description (What statement). The event is created when Exchange Online Mailbox activity is detected that does not have a corresponding event defined in Change Auditor.	Low

Self Service Tools: Knowledge Base; Notifications & Alerts; Product Support; Software Downloads; Technical Documentation; User Forums; Video Tutorials; RSS Feed

Contact Us: Licensing Assistance; Technical Support; View All

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.1.1 - Office 365 and Azure Active Directory Event Reference Guide

Introduction

Events

Office 365 Exchange Online Administration

Office 365 Exchange Online Mailbox