Missing emails

[Jawloms]

Over Easter I moved all our mailboxes from onsite Exchange up to M365. We have a mailbox called "cover" which absent staff send their cover work to. We have a bunch of staff who have access to the mailbox. The main user of it has just been to see me to say that emails keep "just disappearing from it" (fighting sceptical, sarcastic urges here). I'm pretty new to the Purview Audit. What do I look for, and do I look for the activity of the "cover" mailbox, or the other users who have access to it, or all of them? I've already run reports for all activity for today for those users and can't see anything very relevant.

 

Thanks

 

Stuart

[Jawloms]

Nevermind! After the main person asking around a bit, one of the others has been "tidying up". Gee, what a surprise......

[Squelch]

I know you can't really tell from this message but this is my shocked face.

[NegativeKillDeath]

I tend to go broad on the initial audit and then export to csv to narrow down. So for this I would get all "Moved to deleted folder" activities for the approx time frame and search the csv for the mailbox in question.

[PotNoodleTech]

I was just about to say I bet it's other staff deleting things. You beat me too it lol.

 

It's generally a bad idea to have multiple staff sharing a mailbox as things like this happen and no one owns up to being the one to deleted all on a friday night by accident.

[Jawloms]

I was pretty certain it was someone else deleting them rather than a technical problem. Wanted to use the auditing to prove which one!

[HPlum78]

Just as a side note there is a limit to the number of connections to a mailbox / shared mailbox, I have seen issues with my own eyes if you go over 25 concurrent connections.