CmdID

CmdID / PowerShell / Cmdlets / Search

Search-MailboxAuditLog

Use the Search-MailboxAuditLog cmdlet to search mailbox audit log entries matching the specified search terms. Exchange PowerShell reference

From the Exchange PowerShell reference 13 parameters Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

13 in the Exchange PowerShell reference
-IdentityThe Identity parameter specifies a single mailbox to retrieve mailbox audit log entries from.
-DomainControllerThe DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory.
-EndDateThe EndDate parameter specifies the end date of the date range.
-ExternalAccessThe ExternalAccess parameter specifies whether to return only audit log entries for mailbox access by users that are outside of your organization.
-GroupMailboxThe GroupMailbox switch is required to include Microsoft 365 Groups in the search.
-HasAttachmentsThe HasAttachments parameter filters the search by messages that have attachments.
-IncludeInactiveMailbox
-LogonTypesThe LogonTypes parameter specifies the type of logons.
-MailboxesThe Mailboxes parameter specifies the mailboxes to retrieve mailbox audit log entries from.
-OperationsThe Operations parameter filters the search results by the mailbox actions that are logged by mailbox audit logging.
-ResultSizeThe ResultSize parameter specifies the maximum number of mailbox audit log entries to return.
-ShowDetailsThe ShowDetails switch retrieves the details of each log entry from the mailbox.
-StartDateThe StartDate parameter specifies the start date of the date range.