Export (0) Print
Expand All

View the Audit Trail


Applies to: Office 365 Enterprise, Live@edu, Forefront Online Protection for Exchange

Topic Last Modified: 2012-04-05

In the Forefront Online Protection for Exchange (FOPE) Administration Center, the Audit Trail tab on the Tools tab helps you track important events that have occurred in your Forefront Online Protection for Exchange service. From the Audit Trail tab, you can view both user-related and service-related events. Events can be sorted by the email address of the logged on user, Domain, Activity, or Date and time.

You can search for events that relate to a specific company or domain by using the Search box. You can filter results by clicking a view on the Views pane and then specifying a specific Date Range for your search. In order to narrow the returned results, you can specify the Date Range without changing the Search criteria.

The Audit Trail tool tracks changes to an object based on the object ID numbers. Each company, domain, user, and policy filter rule has a unique object ID. When investigating changes to a specific object, for example a specific domain, you can access that domain and then click Track Changes in the Tasks pane. This will take you directly to a filtered view of the audit trail, where you can view the changes that apply specifically to the object (domain) you were viewing. To clear the Track Changes search criteria from the Search box, click Clear.

When viewing the activity for a policy rule in the Audit Trail, the Direction Id and Action Type Id codes map to the following values.

Direction Id:

0 Policy rule is disabled

1 Policy rule is applied to inbound messages

2 Policy rule is applied to outbound messages

Action Type Id:

1 Decrypt

2 Allow

3 Reject

4 Quarantine

5 Redirect

6 Deliver with Bcc

7 Encrypt

8 Test

12 Force TLS

For more information about these action types, see “Policy Filter Actions” in Understanding Policy Rule Settings, and “Policy Rules Combinations” in Understanding Policy Rule Processing.

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

© 2014 Microsoft