I'm currently auditing some inactive shared mailboxes and need help figuring out when a specific mailbox was last accessed. For my example, let's use the AP mailbox ([email protected]) for Accounts Payable. This mailbox is essentially disabled from signing in, and since I forgot the password, I've been using it to check if it appears in my reports.
In past audits, I relied on Get-MailboxStatistics, which shows the LastLogonTime, and this worked well for my needs. However, I've been trying to find similar info via Graph API. When I use Get-MGUser, it shows a recent failed login attempt from 5 days ago, but LastNonInteractiveSignInDateTime is two years ago. I've also tried Get-MgReportEmailActivityUserDetail and Get-MgReportMailboxUsageDetail, but they return similar data that's out of sync with recent activity.
Is there a way to pull the last access time for a shared mailbox using Graph API, or do I need to look into mailbox auditing? Any guidance would be appreciated!
2 Answers
Have you checked the Last Activity Date from Get-MgReportMailboxUsageDetail? It should provide the last access times for both the shared mailbox and any user activity related to it. Just keep in mind that it might not always be completely accurate if there are multiple accesses happening. Let me know if that helps!
Yes, but the last activity date showing is 2025-05-09, and I've seen activity in the mailbox today, so it doesn't seem reliable.
If you're open to using something outside of Graph, the ExchangeOnlineManagement module has a command called Search-UnifiedAuditLog. This can provide detailed actor information, but verify the mailbox is set for auditing. The documentation on Microsoft's site can guide you on how to implement it.
This command is what I rely on too! The 'Last Activity Date' should definitely reflect when there were 'send' or 'read' actions.