Skip to content

Latest commit

 

History

History
159 lines (124 loc) · 4.2 KB

New-AuditConfigurationRule.md

File metadata and controls

159 lines (124 loc) · 4.2 KB
Raw
external help file online version applicable title schema author ms.author ms.reviewer
Microsoft.Exchange.TransportMailflow-Help.xml
Security & Compliance
New-AuditConfigurationRule
2.0.0
chrisda
chrisda

New-AuditConfigurationRule

SYNOPSIS

This cmdlet is available only in Security & Compliance PowerShell. For more information, see Security & Compliance PowerShell.

Use the New-AuditConfigurationRule cmdlet to create audit configuration rules.

For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.

SYNTAX

New-AuditConfigurationRule -AuditOperation <MultiValuedProperty> -Workload <Workload>
 [-Confirm]
 [-DomainController <Fqdn>]
 [-WhatIf]
 [<CommonParameters>]

DESCRIPTION

To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see Permissions in the Microsoft Purview compliance portal.

EXAMPLES

Example 1

New-AuditConfigurationRule -Workload SharePoint -AuditOperation Delete

This example creates a new audit configuration rule for Microsoft SharePoint Online that audits delete operations.

PARAMETERS

-AuditOperation

The AuditOperation parameter specifies the operations that are audited by the rule. Valid values are:

  • Administrate
  • CheckIn
  • CheckOut
  • Count
  • CreateUpdate
  • Delete
  • Forward
  • MoveCopy
  • PermissionChange
  • ProfileChange
  • SchemaChange
  • Search
  • SendAsOthers
  • View
  • Workflow

You can specify multiple values separated by commas.

Type: MultiValuedProperty
Parameter Sets: (All)
Aliases:
Applicable: Security & Compliance

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Workload

The Workload parameter specifies where the audit configuration policy applies. Valid values are:

  • Exchange
  • OneDriveForBusiness
  • SharePoint
Type: Workload
Parameter Sets: (All)
Aliases:
Applicable: Security & Compliance

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.

  • Destructive cmdlets (for example, Remove-* cmdlets) have a built-in pause that forces you to acknowledge the command before proceeding. For these cmdlets, you can skip the confirmation prompt by using this exact syntax: -Confirm:$false.
  • Most other cmdlets (for example, New-* and Set-* cmdlets) don't have a built-in pause. For these cmdlets, specifying the Confirm switch without a value introduces a pause that forces you acknowledge the command before proceeding.
Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf
Applicable: Security & Compliance

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-DomainController

This parameter is reserved for internal Microsoft use.

Type: Fqdn
Parameter Sets: (All)
Aliases:
Applicable: Security & Compliance

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

The WhatIf switch doesn't work in Security & Compliance PowerShell.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi
Applicable: Security & Compliance

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

NOTES

RELATED LINKS