Security Compliance

Exchange Online Logga Does Not Work in ARM (ARM 2023.2–2025.4): Microsoft Audit Log Cmdlet Retirement

This article addresses a critical issue where the Exchange Online Logga feature in SolarWinds Access Rights Manager (ARM) fails to function.

First published date

1/12/2026 11:41 AM

Last published date

4/9/2026 2:03 PM

Overview

Administrators using ARM (versions 2023.2, 2024.3, 2025.1, 2025.2, 2025.4) with Exchange Online may find that the Exchange Online Logga feature does not collect or display any mailbox audit events. After enabling Logga, it may turn off automatically or appear to run without collecting data. This issue began after Microsoft changed how audit logs are accessed in Exchange Online, deprecating the cmdlets that ARM relied on. The impact is that mailbox activity logging for compliance and security monitoring is unavailable through ARM until a product update is released

Product section

Access Rights Manager

Cause

This has been identified as a known issue in ARM.

 

  • Microsoft Deprecation: Microsoft has retired the Search-MailboxAuditLog and New-MailboxAuditLogSearch cmdlets in Exchange Online. As of March 1, 2025, new audit log data is no longer written to mailboxes, and these cmdlets will be fully removed by the end of 2025.
  • ARM Dependency: ARM’s Exchange Online Logga feature depends on these cmdlets to collect mailbox audit logs. With their deprecation, the Logga cannot function.
  • New Requirement: Microsoft now requires the use of the Search-UnifiedAuditLog cmdlet for audit log access, which ARM does not yet support for this feature.

 

 

Resolution

A fix for this issue is planned for a future release of ARM. As of January 12, 2026, there are no workarounds. Please watch this article for updates.