The following table lists the activities that can be logged by mailbox audit logging. Mailbox activities performed by the mailbox owner, a delegated user, or an administrator are logged. By default, mailbox auditing in Office 365 isn’t turned on. Mailbox audit logging must be turned on for each mailbox before mailbox activity will be logged.


Friendly name
Operation
Description
Copied messages to another folder
Copy
A message was copied to another folder.
Created or received messages
Create
An item is created in the Calendar, Contacts, Notes, or Tasks folder in the mailbox; for example, a new meeting request is created. Note that message or folder creation isn't audited.
Deleted messages from Deleted Items folder
SoftDelete
A message was permanently deleted or deleted from the Deleted Items folder. These items are moved to the Recoverable Items folder. Messages are also moved to the Recoverable Items folder when a user selects it and presses Shift+Delete.
Moved messages to another folder
Move
A message was moved to another folder.
Moved messages to Deleted Items folder
MoveToDeletedItems
A message was deleted and moved to the Deleted Items folder.
Purged messages from the mailbox
HardDelete
A message was purged from the Recoverable Items folder (permanently deleted from the mailbox).
Sent message using Send As permissions
SendAs
A message was sent using the SendAs permission. This means another user sent the message as though it came from the mailbox owner.
Sent message using Send On Behalf permissions
SendOnBehalf
A message was sent using the SendOnBehalf permission. This means another user sent the message on behalf of the mailbox owner. The message indicates to the recipient who the message was sent on behalf of and who actually sent the message.
Updated message
Update
A message or its properties was changed.
User signed in to mailbox
MailboxLogin
The user signed in to their mailbox.