View the Audit Trail
Applies to: Office 365 for enterprises, Live@edu, Forefront Online Protection for Exchange
Topic Last Modified: 2012-04-05
In the Forefront Online Protection for Exchange (FOPE) Administration Center, the Audit Trail tab on the Tools tab helps you track important events that have occurred in your Forefront Online Protection for Exchange service. From the Audit Trail tab, you can view both user-related and service-related events. Events can be sorted by the email address of the logged on user, Domain, Activity, or Date and time.
You can search for events that relate to a specific company or domain by using the Search box. You can filter results by clicking a view on the Views pane and then specifying a specific Date Range for your search. In order to narrow the returned results, you can specify the Date Range without changing the Search criteria.
|The Audit Trail tool tracks changes to an object based on the object ID numbers. Each company, domain, user, and policy filter rule has a unique object ID. When investigating changes to a specific object, for example a specific domain, you can access that domain and then click Track Changes in the Tasks pane. This will take you directly to a filtered view of the audit trail, where you can view the changes that apply specifically to the object (domain) you were viewing. To clear the Track Changes search criteria from the Search box, click Clear.|
When viewing the activity for a policy rule in the Audit Trail, the Direction Id and Action Type Id codes map to the following values.
0 Policy rule is disabled
1 Policy rule is applied to inbound messages
2 Policy rule is applied to outbound messages
Action Type Id:
6 Deliver with Bcc
12 Force TLS