Bald Eagle

Audit logging in EasyLife 365 Mail records a more complete and more accurate set of events. Deletions and completed provisioning are now recorded, owner changes name the owner who changed, and a handful of event IDs have been corrected. This release also brings audit logging to production.

What's new?

Audit logging

• Deleting a mailbox or a distribution list from Cockpit is now recorded, as DELETE-MAILBOX and DELETE-DISTRIBUTION-LIST. Neither deletion left an entry before.
• Creating a mailbox or a distribution list now records that it exists, not only that someone asked for it. The Engine writes an ENGINE entry naming the person it was created for, keyed on the new resource, so it appears in that resource's own Logs section.
• Access reviews are recorded: starting one, completing a step, and cancelling one.
• Changing a distribution list's owners from Cockpit is recorded, as ASSIGN-OWNER and REMOVE-OWNER. That surface previously produced no entry at all.

Corrected event IDs

• On a mailbox, CHANGE-OWNER is replaced by ASSIGN-OWNER and REMOVE-OWNER, and one entry is written per owner. The single CHANGE-OWNER entry it replaces packed every added and removed owner into one row, so it could not tell you who had actually been added and who removed.
• Changes an owner makes to their own mailbox's owners are now categorised ACCOUNT rather than ADMIN. That endpoint only ever accepted a request from an existing owner, so ADMIN described it wrongly.
• CREATE-POLICY, UPDATE-POLICY, DELETE-POLICY, DUPLICATE-POLICY, UPDATE-BLOCKLIST and UPDATE-TENANT-SETTINGS are retired. Policies, the blocklist and tenant settings each already record who created and last modified them and keep their previous versions, all visible in Cockpit, so a separate audit entry only repeated what the item itself already showed.

Read more in Audit logging.

How these updates will affect you

• If you have not turned on Audit Logging, nothing changes. No mailbox or distribution list is affected.
• This release brings audit logging to production, so production tenants start with the corrected event IDs from their first entry. Only a tenant that turned it on in insiders during 1.25.0 has entries under the old IDs — if that is you, read on.
• Any query, workbook or alert you built on a retired event ID will stop matching. Entries already written keep the ID they were written with, so a query on CHANGE-OWNER still finds historical rows but will match nothing new — point it at ASSIGN-OWNER and REMOVE-OWNER instead. The same applies to the four policy IDs, UPDATE-BLOCKLIST and UPDATE-TENANT-SETTINGS.
• A query that filters mailbox owner changes on Category == ADMIN needs to look for ACCOUNT instead.
• Expect more rows per owner change than before, one for each owner added or removed, and a second entry for each mailbox or distribution list created — unless the request went through an approval, which is tracked as an approval rather than an audit entry.