User audit and traceability

What the screen shows

From Webmail → Audit, a user or authorised operator can view recorded actions according to granted permissions. Typical events include sign-in, sending, act-as, sharing changes, moving and Quarantine actions.

How to read an entry

Check:

• who the actor was;
• which mailbox or message was affected;
• when it happened;
• the outcome;
• the mailbox context used.

During a dispute

Do not modify data before preserving identifiers and the time period. The system audit may contain additional technical events for mail flow and security. The user screen is a helpful view, not the only evidence source for an investigation.