Email inbox management and history

Question

Email inbox management and history

Rodriguez, Ben 0

How can I learn who opened an email from a shared email inbox?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @Rodriguez, Ben ,

I hope you're doing well.

Outlook does not provide a built-in way to determine who read a message in a shared mailbox because shared mailboxes do not maintain a per-user read history. However, if mailbox auditing was enabled when the activity occurred, an administrator may be able to investigate message access by using Microsoft Purview audit logs and reviewing MailItemsAccessed events.

The MailItemsAccessed mailbox auditing action is designed to help organizations investigate email data exposure and compromised accounts by auditing access to mailbox data by mail clients and protocols. For Bind operations, which represent access to individual email messages, the audit records contain the message's InternetMessageId, allowing investigators to correlate audit records with specific email messages.

As a result, if a corresponding MailItemsAccessed audit record exists, an administrator may be able to identify which user account accessed a specific email in the shared mailbox by reviewing audit details such as the user account, timestamp, client information, and message identifier.

To investigate your case, you can try the following steps:

Contact your Microsoft 365 administrator or security/compliance team.
Ask them to search the Unified Audit Log for MailItemsAccessed records during the relevant time period.
Filter the results for MailAccessType = Bind. A Bind represents individual access to an email message.
Locate the email's InternetMessageId in the audit records. Microsoft records this identifier for messages accessed through Bind operations.
Review fields such as User, MailboxUPN, ClientIPAddress, and ClientInfoString to help determine which account and client accessed the message.

Please note that the audit record indicates that the message was accessed by a client or protocol and should not be interpreted as definitive proof that the message was read.

User's image

For detailed investigation steps, see Use MailItemsAccessed to investigate compromised accounts.

I hope this helps!

Kind Regards.

Answer 2

Outlook cannot show which delegate changed a message’s shared read/unread status; if Microsoft 365 E5 auditing captured the event, an administrator can instead search Microsoft Purview for MailItemsAccessed records associated with that message.

Search for recorded access

This is not self-service for an ordinary Outlook user. Ask a Microsoft 365 administrator or compliance team member with the Audit Logs or View-Only Audit Logs role to perform the search. The role assignments are under Microsoft Purview portal → Settings → Roles and scopes → Role groups.^1^

In Microsoft Purview Audit:

Set a narrow Date and time range in UTC around when the message was likely accessed.
For a shared mailbox, enter its primary SMTP address in Keywords, not Users.
Select the Accessed mailbox items (MailItemsAccessed) activity.
Run the search, then inspect or export matching records.
Correlate the available user, timestamp, and item information with the target message. Narrowing the time range and candidate delegates makes this easier.

MailItemsAccessed means mailbox data was accessed by a client or protocol. It can be triggered when Outlook binds to messages or when a protocol synchronizes a folder, so a result indicates access—not conclusive proof that someone intentionally read and understood the message.^2^

Exchange Online PowerShell alternative

After connecting to Exchange Online PowerShell, an administrator can search specific delegates and the shared mailbox. Replace the sample addresses and dates:

Connect-ExchangeOnline

$delegates = "[Email]","[Email]"
$sharedMailbox = "[Email]"

Search-UnifiedAuditLog `
  -StartDate "2026-11-01" -EndDate "2026-11-03" `
  -UserIds $delegates `
  -FreeText $sharedMailbox `
  -Operations MailItemsAccessed `
  -ResultSize 200

For shared-mailbox investigations, -UserIds identifies actions performed by candidate delegates, while -FreeText identifies activity in the shared mailbox. Capturing MailItemsAccessed requires Microsoft 365 E5 licensing.^3^

Important limitations

A shared mailbox has one common read/unread state. It does not maintain a separate read state or reader history for each delegate, and mailbox auditing does not provide a specific “marked read/unread by user” event.^4^
Audit records are available only if the applicable activity was captured when it occurred. Enabling or correcting auditing now cannot reconstruct an older, unrecorded event.
Standard audit retention is 180 days unless Audit Premium licensing and an applicable retention policy preserve records longer.^1^
If E5-backed MailItemsAccessed data was unavailable at the time, or the record has aged out, there is no Outlook or shared read-status history that can determine who opened that specific message.
FolderBind can show that a delegate accessed a folder, but not necessarily that they opened the particular message; delegate folder-access records are also consolidated within a 24-hour period.^5^

For future workflow tracking, use categories, flags, or an assignment/ticketing process rather than relying on the shared unread indicator.

References