Comments on: Handling the Too Many Retries Error and Dealing with Odd Numbers of Audit Events https://office365itpros.com/2024/08/14/auditlog-query-oddities/?utm_source=rss&utm_medium=rss&utm_campaign=auditlog-query-oddities Mastering Office 365 and Microsoft 365 Sat, 24 Aug 2024 11:12:45 +0000 hourly 1 By: Tony Redmond https://office365itpros.com/2024/08/14/auditlog-query-oddities/#comment-12751 Sat, 24 Aug 2024 11:12:45 +0000 https://office365itpros.com/?p=65970#comment-12751 In reply to D.

FolderBind is an Exchange Online mailbox audit record. It indicates the time when a non-owner accesses a mailbox folder. You could report the problem as a support issue to Microsoft to make sure that it gets recorded. It’s the only way the engineering team will spend any time considering the issue.

]]>
By: D https://office365itpros.com/2024/08/14/auditlog-query-oddities/#comment-12750 Sat, 24 Aug 2024 09:16:15 +0000 https://office365itpros.com/?p=65970#comment-12750 In reply to Tony Redmond.

A good idea thanks. I tried that and it seemed to be missing. ChatGPT and its friends seemed to hallucinate trying to track down an opperation called FolderBind but it didn’t uncover anthing. I would have thought it would have been a basic audit event to know if someone was adding open calendars in your organisation in the hope of gaining advantage they perhaps shouldn’t have. Thanks

]]>
By: Tony Redmond https://office365itpros.com/2024/08/14/auditlog-query-oddities/#comment-12734 Thu, 22 Aug 2024 16:44:17 +0000 https://office365itpros.com/?p=65970#comment-12734 In reply to D.

Whar I do to find new audit events is to perform the action I want to know about, wait 3 hours, and then search the audit log for my userid and the approximate timeframe when I performed the action.

]]>
By: D https://office365itpros.com/2024/08/14/auditlog-query-oddities/#comment-12733 Thu, 22 Aug 2024 16:09:45 +0000 https://office365itpros.com/?p=65970#comment-12733 Always a good read. I’m stuck for finding if a particular event is recorded in the audit logs. It doesn’t seem to be unless it has a cryptic name. I’m want to know if a user adding another user’s calendar shows up in the audit log.

]]>