Troubleshooting Microsoft Exchange Online — Question 6

A company uses Exchange Online.
A user named User1 reports that emails are missing from their mailbox. You perform an audit log search and are unable to locate any logs for User1.
You need to identify the cause of the missing audit logs.
Which two commands can you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Answer options

• A. Get-MsolUser –SearchString User1 | Format-List Licenses
• B. Get-MailboxAuditBypassAssociation –Identity User1 | Format-List AuditByPassEnabled
• C. Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
• D. Get-OrganizationConfig | Format-List AutditDisabled

Correct answer: B, D

Explanation

Option B allows you to check if mailbox audit logging is bypassed for User1, which would explain the absence of logs. Option D helps confirm whether auditing is disabled for the organization as a whole, which would also result in missing logs. Options A and C do not directly address the audit log issue for User1.