The Problem
Biweekly auditing of mailbox permission changes is an enterprise compliance requirement. Producing that report manually meant searching the unified audit log by hand every cycle, and the raw audit data returns identities as GUIDs and internal identifiers rather than readable email addresses, so the output required interpretation before anyone could act on it. There was also no consistent historical archive, which made responding to auditor requests for earlier periods difficult.
What I Built
A fully automated PowerShell report that pulls mailbox permission changes from the Microsoft 365 unified audit log on a biweekly cadence, resolves raw identifiers into readable email addresses, exports to a timestamped CSV, and emails the report to the security team. Reports are retained historically so any prior period can be produced on request.
How It Works
- Certificate-based app-only authentication to both Exchange Online and Microsoft Graph, so it runs unattended with no stored secrets
- Queries the unified audit log for the four relevant operations: Add-MailboxPermission, Remove-MailboxPermission, Add-RecipientPermission, and Remove-RecipientPermission, over a rolling 14-day window
- Two-tier identity resolution: audit records return GUIDs and internal identifiers, so each identity is resolved first through an Exchange Online recipient lookup, then falling back to Microsoft Graph, and finally to the raw value if neither resolves
- In-memory resolution cache so repeated identities are only looked up once per run, keeping large reports fast
- Both raw and resolved values are written to the report, preserving the original audit data alongside the human-readable version
- Timestamped output filenames so every run is retained rather than overwritten, building a historical archive
- Explicit handling for periods with no changes, so an empty report is never mistaken for a failed run
- Emails the CSV as an attachment through Microsoft Graph
Who Uses It
The report goes to the security team and is used primarily by the compliance, audit, and risk function, which monitors for unauthorized delegation and verifies that permission changes correspond to approved change requests.
Impact
- Replaces a recurring manual audit log review with a fully automated biweekly report
- Converts raw GUIDs into readable identities so the data is actionable without interpretation
- Maintains a historical archive so any prior reporting period can be produced immediately for auditors
- Satisfies an enterprise compliance requirement with no ongoing administrative effort