The following table lists the activities that can be logged by mailbox audit logging. Mailbox activities performed by the mailbox owner, a delegated user, or an administrator are logged. By default, mailbox auditing in Office 365 isn’t turned on. Mailbox audit logging must be turned on for each mailbox before mailbox activity will be logged.
|Copied messages to another folder
||A message was copied to another folder.
|Created or received messages
||An item is created in the Calendar, Contacts, Notes, or Tasks folder in the mailbox; for example, a new meeting request is created. Note that message or folder creation isn't audited.
|Deleted messages from Deleted Items folder
||A message was permanently deleted or deleted from the Deleted Items folder. These items are moved to the Recoverable Items folder. Messages are also moved to the Recoverable Items folder when a user selects it and presses Shift+Delete.
|Moved messages to another folder
||A message was moved to another folder.
|Moved messages to Deleted Items folder
||A message was deleted and moved to the Deleted Items folder.
|Purged messages from the mailbox
||A message was purged from the Recoverable Items folder (permanently deleted from the mailbox).
|Sent message using Send As permissions
||A message was sent using the SendAs permission. This means another user sent the message as though it came from the mailbox owner.
|Sent message using Send On Behalf permissions
||A message was sent using the SendOnBehalf permission. This means another user sent the message on behalf of the mailbox owner. The message indicates to the recipient who the message was sent on behalf of and who actually sent the message.
||A message or its properties was changed.
|User signed in to mailbox
||The user signed in to their mailbox.