To group mailboxes by what is enabled, run the following commands: $Group = $Mailboxes | Group-Object AuditEnabled,AuditDelegate | Select- Object Expression= $Group | Format-Table -AutoSize

To get all mailboxes, run the following command: $Mailboxes = (Get-Mailbox) To enable the admin audit log, run the following command: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true To open the credentials prompt for O365, run the following commands: $Session = New-PSSession -ConfigurationName Microsoft.Exchange - ConnectionUri - Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session In the Windows PowerShell Credential Request dialog box, type your O365 user name and password, and then click OK.

Open Windows PowerShell on your local system, and then run the following command: $UserCredential = Get-Credential Before mailbox auditing was turned on by default, you had to manually enable it for every user mailbox in your organization. This means that certain actions performed by mailbox owners, delegates, and admins are automatically logged, and the corresponding mailbox audit records will be available when you search for them in the mailbox audit log. Starting in January 2019, Microsoft turned on mailbox audit logging by default for all organizations.

Download office 365 admin log in