Auditing Deletions of Exchange Online Public Folders

We are very glad to announce new auditing feature added to Exchange Online public folders. The feature allows you to monitor/track public folder deletions in the organization.

Public folder deletions performed using any client (Outlook desktop client, Exchange admin center, Exchange Online PowerShell etc.) are all audited.

The feature is now available for all Exchange Online tenants.

The following are the steps to track the deletion:

• Login to Microsoft Purview Compliance portal (https://compliance.microsoft.com/)
• Select Audit and specify the following under New Search
  • Date range for which auditing entries should be searched
  • Under Record types select Public Folder
  • Provide a meaningful search name and click on Search

The search will get queued, and should complete in a few minutes.

You can view the search results in the in the Purview Compliance portal and export the results as well.

Here are some examples:

Public folder deletion from client:

Public folder deletion from Exchange admin center or Exchange Online PowerShell:

The Microsoft Purview Auditing feature is enabled by default for all the tenants with the appropriate subscription and the auditing logs are retained for 90 days for Audit (Standard). They can be retained for longer periods with other subscriptions.  Please check this page for more details on Microsoft Purview auditing.

Exchange Online Public Folder Team