Introduction of EX_MailboxAccessActivity Job for Exchange Online

Products Access Analyzer Show & Tell
, ,
1

:megaphone: Product Bulletin

Introduction of EX_MailboxAccessActivity Job for Exchange Online
Product: Netwrix Access Analyzer
Affected Versions: 11.5+
Date: August 2025
Audience: Engineers, Administrators, Technical Partners, and End Users

:magnifying_glass_tilted_left: Overview

We are introducing the EX_MailboxAccessActivity job as part of the Exchange Solution Set in Netwrix Access Analyzer (NAA). This update addresses Microsoft’s deprecation of the cmdlet previously used by the EX_MailboxActivity job to retrieve Exchange Online activity.

image
image502Ă—758 63.6 KB

:gear: Technical Details

The new EX_MailboxAccessActivity job uses the Search-UnifiedAuditLog cmdlet, with:

This update ensures compatibility with Microsoft’s modern auditing infrastructure for Exchange Online.

:counterclockwise_arrows_button: Important: The previous EX_MailboxActivity job will continue to function only for Exchange On-Premises targets and is no longer supported for Entra tenants.

To collect Exchange Online activity, use the new job path:
8. Exchange Online > Mailboxes > 0. Collection > EX_MailboxAccessActivity

:bookmark_tabs: Legacy Cmdlet Deprecation

The legacy EX_MailboxActivity job uses the now-deprecated Search-MailboxAuditLog cmdlet. While Microsoft has removed support for this cmdlet in Exchange Online, it remains available for Exchange On-Premises environments.

:bar_chart: Report Output Consistency

The output of the new EX_MailboxAccessActivity job closely mirrors that of the former EX_MailboxActivity job when used with Exchange Online. While dedicated documentation is coming soon, users can continue referencing the existing material for interpreting report results:
:blue_book: EX_MailboxLogons Documentation – Netwrix Help Center

:white_check_mark: Job Requirements

There are no changes to the requirements for running this job. All prerequisites for Exchange Online—including audit configurations and permissions—remain the same as with the legacy job.
:blue_book: Exchange Online Requirements – Netwrix Help Center

:package: Availability & Hotfixes

The EX_MailboxAccessActivity job will be officially included in a future Cumulative Update (CU) for Netwrix Access Analyzer. While this CU is not yet released, we encourage all customers and internal users to apply the available hotfixes to enable the job now:

Version Hotfix Link
11.5 Download 11.5.0.102
11.6 Download 11.6.0.086
12.0 Download 12.0.0.009

Applying the appropriate hotfix ensures early access to the new job before the official CU release.

2 Likes