Office365ExchangeAdmin log type

Description

Events from the Exchange admin audit log.

Log Structure

[
{
"CreationTime": "2022-03-14T08:57:52",
"Id": "80c76bd2-9d81-4c57-a97a-accfc3443dca",
"Operation": "Enable-AddressListPaging",
"OrganizationId": "41463f53-8812-40f4-890f-865bf6e35190",
"RecordType": 1,
"ResultStatus": "True",
"UserKey": "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)",
"UserType": 3,
"Version": 1,
"Workload": "Exchange",
"ObjectId": "contoso.onmicrosoft.com",
"UserId": "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)",
"AppId": "",
"ClientAppId": "",
"ExternalAccess": true,
"OrganizationName": "contoso.onmicrosoft.com",
"OriginatingServer": "ME3P282MB3790 (15.20.5061.028)",
"Parameters": [
{
"Name": "DoNotUpdateRecipients",
"Value": "True"
},
{
"Name": "DomainController",
"Value": ""
},
{
"Name": "Identity",
"Value": "PHP101A112.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com"
}
]
}
]

Table Fields

Field	Description

Field	Description
TABLE	Office365ExchangeAdmin
RECORDTYPE	Based on RecordType, this field indicates the operation performed by the record. For this log type its value is 1. For available RecordType values, you can visit Microsoft’s documentation here.
APPID	Based on AppId, there’s no available documentation for this field.
CLIENTAPPID	Based on ClientAppId, there’s no available documentation for this field.
MODOBJECTRESOLVENAME	Based on ModifiedObjectResolvedName, this field contains the the user-friendly name of the object that was modified by the cmdlet.
MODIFIEDPROPERTIES	Based on ModifiedProperties, this field contains the name of the property that was modified, the new value of the modified property, and the previous value of the modified object.
PARAMS	Based on Parameters, this field contains the name and value for all parameters that were used with the cmdlet that is identified in the Operations property.
EXTERNALACCESS	Based on ExternalAccess, this field contains the details that specifies whether the cmdlet was run by a user in your organization, by Microsoft datacenter personnel or a datacenter service account, or by a delegated administrator.
ORIGINATINGSERVER	Based on OriginatingServer, this field contains the name of the server from which the cmdlet was executed.
ORGNAME	Based on OrganizationName, this field contains the name of the tenant.
SNAREDATAMAP	All unclassified field(s) parsed from this log type will be pushed into the SNAREDATAMAP.

Notes

Office 365 Management Activity API schema