Logging
Audit logging records governance actions on mailboxes and distribution lists — such as creations, template and policy changes, confirmations, and engine escalations — and stores them in Azure Log Analytics. Audit logs can be used as evidence for compliance, access reviews, and audit trails. For end-to-end configuration steps, see Configure audit logging.
Toggle Enable audit logging to start sending events to your Azure Application Insights and Log Analytics workspace. Two endpoints can be configured:
- Ingestion Mode (Application Insights connection string) — Paste the connection string from the Application Insights resource. Required when audit logging is enabled. Changes may take up to 24 hours to propagate.
- Reading Mode (Log Analytics workspace ID) — Paste the Log Analytics workspace ID linked to the Application Insights resource. Grant the EasyLife app Log Analytics Reader access to view logs from within EasyLife 365 Admin.
To view logs of resources from within EasyLife 365 Admin, ensure the Reading Mode configuration is in place.
Once audit logging is enabled and reading mode is configured, governance events are forwarded to your Application Insights and you can monitor activities for a resource directly from EasyLife 365 Admin:
- Visit
Manageand open a shared mailbox, room mailbox, equipment mailbox, or distribution list. - The details panel shows a log of all recorded actions taken on that resource, listed chronologically with the newest first.
Microsoft 365 Audit Logs
In addition to EasyLife event logging, Microsoft 365 Audit Logs provide a robust tool for tracking app and user activities. By leveraging tailored filters for EasyLife 365 apps, customers can navigate and review logged activities within their tenant's audit logs.
Available Events
The following section outlines all events tracked through the audit logging feature, categorized by capability area.
Some event IDs are intentionally reused across resource types (for example ASSIGN-POLICY or CONFIRM) — the resource itself and the Category disambiguate which capability area an event belongs to, not the EventId.
The headings below group events by where the action happens: Admin Activities are what an administrator does in EasyLife 365 Admin, User Activities are self-service actions a resource owner takes in EasyLife 365 Mail, and Engine Activities are the background service acting without a person present — which includes finishing work a user asked for earlier.
The Category column is a separate axis and does not line up with those headings one for one. POLICY events appear under both Admin Activities and User Activities, so filtering on Category == ADMIN alone will not return every administrator action. The two ASSIGN-TEMPLATE events carry ADMIN even though an owner triggers them from EasyLife 365 Mail.
Mailbox Management
Admin Activities
| Category | EventId | Description |
|---|---|---|
| ADMIN | ASSIGN-TEMPLATE | An owner assigns a template to a mailbox |
| ADMIN | DELETE-MAILBOX | An admin deletes a mailbox |
| POLICY | ASSIGN-POLICY | An admin assigns a policy to a mailbox |
| POLICY | REMOVE-POLICY | An admin removes a policy from a mailbox |
User Activities
| Category | EventId | Description |
|---|---|---|
| ACCOUNT | CREATE-MAILBOX | A user requests a shared, room, or equipment mailbox |
| ACCOUNT | ASSIGN-OWNER | An owner assigns another owner to a mailbox |
| ACCOUNT | REMOVE-OWNER | An owner removes an owner from a mailbox |
| ACCOUNT | START-ACCESSREVIEW | An owner starts an access review for a mailbox |
| ACCOUNT | COMPLETE-ACCESSREVIEW-STEP | An owner completes a step of a mailbox access review |
| ACCOUNT | CANCEL-ACCESSREVIEW | An owner cancels a mailbox access review |
| POLICY | CONFIRM | An owner confirms a mailbox |
One event is recorded per owner, so assigning one owner while removing another produces an ASSIGN-OWNER and a REMOVE-OWNER entry rather than a single combined one.
Engine Activities
| Category | EventId | Description |
|---|---|---|
| ENGINE | CREATE-MAILBOX | Creates a mailbox on behalf of the user who requested it |
| ENGINE | ASSIGN-POLICY | Applies a policy to a mailbox during an engine scan |
| ENGINE | DELETE | Deletes a mailbox due to an escalation |
| ENGINE | REMOVE-PERMISSIONS | Removes permissions from a mailbox due to an escalation |
A mailbox creation normally produces two entries: the ACCOUNT event recording that it was requested, and the ENGINE event recording that it now exists. Fewer appear when the request goes through an approval, which is tracked as an approval instead of an ACCOUNT event, or when provisioning does not succeed — an approved request that then fails to provision records neither. The two entries are also keyed differently — the ACCOUNT event on the request id, the ENGINE event on the Entra object id — and the resource's own log in EasyLife 365 Admin is keyed on the latter.
Distribution List Management
Admin Activities
| Category | EventId | Description |
|---|---|---|
| ADMIN | ASSIGN-TEMPLATE | An owner assigns a template to a distribution list |
| ADMIN | ASSIGN-OWNER | An admin assigns an owner to a distribution list |
| ADMIN | REMOVE-OWNER | An admin removes an owner from a distribution list |
| ADMIN | DELETE-DISTRIBUTION-LIST | An admin deletes a distribution list |
| POLICY | ASSIGN-POLICY | An admin assigns a policy to a distribution list |
| POLICY | REMOVE-POLICY | An admin removes a policy from a distribution list |
One event is recorded per owner here too, so replacing one owner with another produces an ASSIGN-OWNER and a REMOVE-OWNER entry rather than a single combined one.
User Activities
| Category | EventId | Description |
|---|---|---|
| ACCOUNT | CREATE-GROUP | A user requests a distribution list |
| ACCOUNT | START-ACCESSREVIEW | An owner starts an access review for a distribution list |
| ACCOUNT | COMPLETE-ACCESSREVIEW-STEP | An owner completes a step of a distribution list access review |
| ACCOUNT | CANCEL-ACCESSREVIEW | An owner cancels a distribution list access review |
| POLICY | CONFIRM | An owner confirms a distribution list |
Engine Activities
| Category | EventId | Description |
|---|---|---|
| ENGINE | CREATE-GROUP | Creates a distribution list on behalf of the user who requested it |
| ENGINE | DELETE | Deletes a distribution list due to an escalation |
| ENGINE | REMOVE-GUESTS | Removes guests from a distribution list due to an escalation |
| ENGINE | REMOVE-PERMISSIONS | Removes permissions from a distribution list due to an escalation |
A distribution list creation normally produces two entries: the ACCOUNT event recording that it was requested, and the ENGINE event recording that it now exists. Fewer appear when the request goes through an approval, which is tracked as an approval instead of an ACCOUNT event, or when provisioning does not succeed — an approved request that then fails to provision records neither. The two entries are also keyed differently — the ACCOUNT event on the request id, the ENGINE event on the Entra object id — and the resource's own log in EasyLife 365 Admin is keyed on the latter.
Configuration Changes
Changes to policy definitions, the email address block list, and tenant settings do not emit a dedicated audit event. Each of these entities records its own Created / Created By and Modified / Modified By metadata, and previous versions remain available from EasyLife 365 Admin, so the change history is already held on the object itself. Assigning a policy to a mailbox or a distribution list is a different action, and is audited in the tables above.
Collected Values
Each event entry contains essential details including ObjectId, DisplayName, Category, EventId, PreviousValue, NextValue, Description, CreatedBy, and Created.