purview

submit this search in that same tab (or enable View → Developer → Allow JavaScript from Apple Events and tell me — then I can fill and submit it):

Field Value
Start (UTC)
Jul 15 2026, 00:00
End (UTC)
Sep 09 2026, 23:59
Activities – operation names
SoftDelete,HardDelete,MoveToDeletedItems
Users
norm@rocklandbakery.com
Search name
norm-deletes-20260715
That is Audit (Standard) and works on E1 / Exchange Plan 1. After it finishes I will:

Filter rows whose folder path is Sent Items / Sent (that is the “deleted from Sent” set).
Run the same three operations for ranselmo@rocklandbakery.com over the same dates (actor vs mailbox).
Follow with inbox-rule / forwarding / Send / MailboxLogin if the delete set is thin.
License note: MailItemsAccessed is often empty without Audit Premium. Empty there is not a clean bill of health.