Q: (from Keith)
We need to know who (which admin account) created a couple specific email accounts in the past 2 months.
A:
This type of information is easy to extract IF you have audit logging turned on. The first step is to see if you have an audit log and turn the feature on:
If you don’t have logging turned on, the details that can be extracted is a little more limited and can be viewed through PowerShell:
https://technet.microsoft.com/EN-US/library/mt614244.aspx
- ExtensionData
- AlternateEmailAddresses
- AlternateMobilePhones
- AlternativeSecurityIds
- BlockCredential
- City
- CloudExchangeRecipientDisplayType
- Country
- Department
- DirSyncProvisioningErrors
- DisplayName
- Errors
- Fax
- FirstName
- ImmutableId
- IndirectLicenseErrors
- IsBlackberryUser
- IsLicensed
- LastDirSyncTime
- LastName
- LastPasswordChangeTimestamp
- LicenseReconciliationNeeded
- Licenses
- LiveId
- MSExchRecipientTypeDetails
- MobilePhone
- ObjectId
- Office
- OverallProvisioningStatus
- PasswordNeverExpires
- PasswordResetNotRequiredDuringActivate
- PhoneNumber
- PortalSettings
- PostalCode
- PreferredDataLocation
- PreferredLanguage
- ProxyAddresses
- ReleaseTrack
- ServiceInformation
- SignInName
- SoftDeletionTimestamp
- State
- StreetAddress
- StrongAuthenticationMethods
- StrongAuthenticationPhoneAppDetails
- StrongAuthenticationProofupTime
- StrongAuthenticationRequirements
- StrongAuthenticationUserDetails
- StrongPasswordRequired
- StsRefreshTokensValidFrom
- Title
- UsageLocation
- UserLandingPageIdentifierForO365Shell
- UserPrincipalName
- UserThemeIdentifierForO365Shell
- UserType
- ValidationStatus
- WhenCreated
The only parameters I could see details on related to the overt account information., but you could exercise your Partner Advisory Hours to get an Office 365 engineer involved:
https://partner.microsoft.com/en-us/membership/core-benefits
to see if there are more details that we track as a regular course of business.
Steve