Exam MS-203 topic 4 question 86 discussion

- Only the running of New-Mailbox is recorded - No actions are recorded

OMG, MSFT is once again bullying with this question. In fact Recipient Management shouldn't be able to assign a license. Furthermore, if you assign an E5 license to a new cloud user, it will automatically create a mailbox. So the whole Admin1 scenario is absurd. Now to the admin audit logs in EXCH 2019 - they will record any actions taken to modify objects in an Exchange organization by default. THIS exactly is what Forkbeard reports in his test, so I presume either he does it on EXCH 2019 or EXO is following the 2019 principle - in which case the online documentation regarding excluded verbs is not correct. Soooo, you either answer what happens in reality, or you answer what you read in theory. I'm afraid, that the "correct" answer will be the theory, simply because that's how the exam questions are created on the first place.

Ok so I tested this. Here are my results: Admin1 performs the following actions: * From the Microsoft 365 admin center, adds a new user named User1 who is assigned a Microsoft Office 365 Enterprise E5 license <-- NOT LOGGED * From Exchange Online PowerShell, runs the New-Mailbox cmdlet <-- LOGGED Admin2 performs the following actions: * From Exchange Online PowerShell, runs the Search-Mailbox cmdlet and specifies the -DeleteContent switch <-- LOGGED (both searches, with and without -DeleteContent were logged, without mentioning if -DeleteContent was used) * From Exchange Online PowerShell, runs the Test-ApplicationAccessPolicy cmdlet <-- NOT LOGGED Correct answers would then be: Admin1: Only the running of New-Mailbox is recorded. Admin2: Only the running of Search-Mailboxis recorded. Now I should mention that I tested this with the ASSUMPTION that both Admin1 and Admin2 have the relevant permissions. I tested this with my Global Admin account whom I added to a Mailbox Import Export Management group, which has the Mailbox Import Export role assigned.

https://learn.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-administrator-audit-log The admin audit log doesn't record actions based on cmdlets that begins with the verbs Get, Search, or Test.

All actions in the first Search-Mailbox in the second, because it has -DeleteContent switch

If the audit only records successful actions (based on what's permitted for a user) then for the first one I'd say New-Mailbox and second is just Search-Mailbox... If however this works as a Windows Server audit (which includes failed attempts) then I'd say All actions in the first and just Search-Mailbox in the second.

Admin doesnt have the proper rights from role assignment to manage licneses, so i'm unsure about the first part second part definitely isn't all actions "The admin audit log doesn't record actions based on cmdlets that begins with the verbs Get, Search, or Test." https://learn.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-administrator-audit-log