Audit Logs for Exchange Mail Flow Rule Changes

? Overview

Exchange Online administrators often need to track changes to mail flow (transport) rules for compliance and troubleshooting purposes.

This article explains how to check audit logs to identify:

• Who created, modified, or deleted a mail flow rule.
• When the change occurred.
• What specific changes were made to the rule.

✅ Prerequisites

You must have the following:

• Roles:
  • Audit Logs role in Microsoft Purview
  • Exchange Administrator or Global Administrator
• Unified Audit Logging must be enabled in your tenant

? Methods to Check Rule Changes

1. Using Microsoft Purview Compliance Portal

1. Go to Microsoft Purview Audit Portal.
2. Navigate to: Audit → Audit Search.
3. In the Activities field, enter these operations:

4. Set the date range and click Search.
5. Review the results and export if needed.

2. Using PowerShell (Recommended for Detailed Output)

Run the following command to search audit logs for transport rule changes:

? Explanation of Parameters

• StartDate / EndDate → Date range for the search.
• Operations → Types of rule operations (create, modify, enable, disable, delete).
• RecordType ExchangeAdmin → Limits search to Exchange admin activities.
• Export-Csv → Saves the output in CSV format for easy analysis.

? Output Example

? Notes

• Always ensure Unified Audit Log is enabled, otherwise no data will be captured.
• For long-term retention, configure Audit log retention policies in Microsoft Purview.
• Microsoft Docs Reference: Search the audit log in the compliance portal