Skip to content

Commit 3569503

Browse files
authored
Update Search-UnifiedAuditLog.md
We need to clarify customer that a wildcard * as we are having a few cases where customer complain they don't get any logs, the solution is to use the wildcard in front of the URL
1 parent 70bef43 commit 3569503

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

exchange/exchange-ps/exchange/Search-UnifiedAuditLog.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,9 @@ Accept wildcard characters: False
193193
```
194194

195195
### -ObjectIds
196-
The ObjectIds parameter filters the log entries by object ID. The object ID is the target object that was acted upon, and depends on the RecordType and Operations values of the event. For example, for SharePoint operations, the object ID is the URL path to a file, folder, or site. For Azure Active Directory operations, the object ID is the account name or GUID value of the account.
196+
The ObjectIds parameter filters the log entries by object ID. The object ID is the target object that was acted upon, and depends on the RecordType and Operations values of the event. For example, for SharePoint operations, the object ID is the URL path to a file, folder, or site. For searching logs in a site you should add a wildcard * in from of the URL of the site. e.g. "https://contoso.sharepoint.com/sites/test/*".
197+
198+
For Azure Active Directory operations, the object ID is the account name or GUID value of the account.
197199

198200
The ObjectId value appears in the AuditData (also known as Details) property of the event.
199201

0 commit comments

Comments
 (0)