Update mailbox-audit-logs.md

Author: Cloud-Writer

Microsoft365/purview/purview/audit-logs/mailbox-audit-logs.md

@@ -1,5 +1,5 @@
 ---
-title: How to use mailbox audit logs in Microsoft 365
+title: Use mailbox audit logs in Microsoft 365
 description: Describes how to use mailbox audit logs to determine when a mailbox was updated unexpectedly or whether items are missing in Microsoft 365 dedicated.
 author: Cloud-Writer
 ms.author: meerak
@@ -18,19 +18,18 @@ search.appverid: MET150
 ms.date: 05/05/2025
 ---
 
-# How to use mailbox audit logs in Microsoft 365
+# Use mailbox audit logs in Microsoft 365
 
 In Microsoft 365, you can run mailbox audit logs to determine when a mailbox was updated unexpectedly or whether items are missing from a mailbox. For example, you may have to do this if items are moved or if they're deleted unexpectedly or incorrectly.
 
 **Note**: For the vNext environment, by default, mailbox audit logs aren't enabled. The feature must be turned on in order for a user to begin a search.
 
-## How to run and check mailbox audit logs
+## Run mailbox audit logs
 
 Mailbox audit logging lets users obtain information about actions that are performed by non-owners and administrators. Mailbox audit logging is available to members of the Audit Reporting Mailbox self-service group only by using Windows Remote PowerShell.
 
 > [!NOTE]
-> - Mailbox audit logging is turned on by default in all organizations. When mailbox auditing on by default is turned on for the organization, the _AuditEnabled_ property for affected mailboxes doesn't change from __False__ to __True__. In other words, mailbox auditing on by default ignores the _AuditEnabled_ property on mailboxes.
-> - Some organizations might not allow you to use mailbox audit logging. In this case, the feature will be turned off for you.
+> Some organizations might not allow you to use mailbox audit logging. In this case, the feature will be turned off for you.
 
 To investigate this issue, create and use a Windows PowerShell script by using the sample script that's provided in Step 1 in this section, and then customize a search. By default, you can investigate actions that are performed by non-owners and administrators. This script exports content in a simplified, comma-separated values (.csv) file to help you troubleshoot reports about items that are missing or that were updated unexpectedly.
 
@@ -204,7 +203,7 @@ The most useful columns of the .csv file are exported. Some of these columns are
 |OperationResult|Status of the operation</br></br>**Note** Operation results include the following: </br>- Failed </br>- PartiallySucceeded </br>- Succeeded |
 |CrossMailboxOperation|Information about whether the operation that's logged is a cross-mailbox operation (for example, copying or moving messages among mailboxes) |
 
-### More information about mailbox audit logging
+### Use Windows Remote PowerShell
 
 - The **Search-MailboxAuditLog**  cmdlet is used in the sample script in Step 1 to search a single mailbox synchronously. You can do this also by running the cmdlet in Windows Remote PowerShell.