![Microsoft Exchange Online: Introducing ActorInfoString in Exchange Online audit logs [MC1066337]](https://mwpro.co.uk/wp-content/uploads/2024/08/pexels-lulizler-3165335-1024x768.webp "Microsoft Exchange Online: Introducing ActorInfoString in Exchange Online audit logs [MC1066337] 1")
Message ID: MC1066337
Coming soon: ActorInfoString, a new audit log field in Microsoft Exchange Online (EXO) designed to improve the accuracy, clarity, and depth of your audit logs. ActorInfoString records the true user agent responsible for each audited event, giving security and compliance teams increased visibility into actions performed in your Exchange Online environment. This update builds on the existing audit schema by capturing more granular information about clients, devices, and applications involved in audited operations.
[When this will happen:]
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out late May 2025 and expect to complete by late May 2025.
[How this will affect your organization:]
Once enabled, ActorInfoString will appear as a new field in your Exchange Online audit logs, alongside existing fields such as ClientInfoString. This addition provides an unambiguous record of which client, device, or application performed a given operation, supporting better investigation of incidents, improved detection of suspicious activity, and strengthened compliance reporting. Existing audit schema fields, records, and integrations will remain unchanged, ensuring a seamless transition without service impact or data loss.
After this rollout, change administrators will see these key improvements:
- Clarity: Easily reveal the true user agent behind every action in your logs.
- Better security: Accelerate investigation and threat detection by tracing the actual source of actions.
- Compliance: Enhance your audit trails to more effectively meet regulatory standards.
- Future-readiness: Prepare your monitoring and log analysis for evolving audit needs.
Use these instructions to find the new field:
- Log into the Exchange Online admin center.
- Go to the Security & Compliance section.
- Select Audit logs from the menu.
- In the Audit logs section, look for the
ActorInfoStringfield under the detailed log entries.
Example of how ActorInfoString should appear for admins:
ee33-4930-9efd-2b7f2c8183b7","RecordType" : 50, “Resultstatus" : "Succeeded","UserKey":"1c6b6 ActorInfoString" : “Client-REST ;Client-RESTSystem;UserAgent-[NoUserAgent] [Appld-1c6b689d-1
[What you need to do to prepare:]
No action is required before rollout. However, we recommend reviewing your log collection and analysis tools to ensure they are ready to consume the new ActorInfoString field. This update is non-disruptive and will not alter your existing audit data or integrations. We will update this message with official documentation and release notes that will provide additional details and best practices for leveraging the new field.
Source: Microsoft
![Microsoft Outlook: Updated behavior for switching back from new Outlook to classic Outlook for Windows [MC1066342]](https://mwpro.co.uk/wp-content/uploads/2024/08/pexels-apasaric-1164675-150x150.webp "Microsoft Outlook: Updated behavior for switching back from new Outlook to classic Outlook for Windows [MC1066342] 2")
![Power Automate – Use your voice to interact with Copilot [MC1066398]](https://mwpro.co.uk/wp-content/uploads/2024/08/pexels-sevenstormphotography-1091201-150x150.webp "Power Automate - Use your voice to interact with Copilot [MC1066398] 3")
The introduction of the ActorInfoString in Microsoft Exchange Online audit logs is set to make waves, and not just the kind you’d feel on a calm lake! This enhancement will bring a refreshing clarity and depth to the audit logs, which is something both admins and users can appreciate.
For admins, the benefits are clear: the new ActorInfoString will provide an unambiguous record of the true user agent behind each action in the logs. This means that when it comes to investigating incidents or detecting suspicious activity, you’ll have a clearer trail to follow. Imagine being a detective with a magnifying glass that actually works—this update is like that for your audit logs! The improved compliance reporting will also help in meeting regulatory standards, making it easier to sleep at night knowing you’re on top of your game.
Users, on the other hand, may not notice the nitty-gritty changes directly, but they will benefit from the enhanced security and compliance measures that stem from this update. A safer Exchange Online environment means that their data is better protected, which is always a win in today’s digital landscape.
As for the impact of these changes, it’s significant. The ability to trace actions back to their true source will undoubtedly bolster security measures, and the seamless integration with existing audit schemas means that admins can adopt this new feature without a hitch. Plus, with no action required on your part before the rollout, it’s a smooth ride ahead!
So, what do you think about these updates? Will they change the way you manage your Exchange Online environment? Share your thoughts and let’s get a conversation going! Don’t forget to check out more insightful posts at mwpro.co.uk for updates on all things Microsoft Exchange.