I had let CG could receive exchange audit log event and show on CG WebConsole.
But I find I want to monitoring user mailauditing (mail send/move/delete) actions...
I refer CGofficial document and create a same user "Ben Smith" , then do same exchange shell command to enable this user mail auditing.
then assign monitoring usermailbox policy to this exchange2016 server...but then try to mail action on this account to to let policy trigger..
But no event been generate ....
I run Search-MailboxAuditing -identity "Ben Smith" on exchange shell windows....no event show.
which action I miss to let exchange to monitor user mail action ?