The encrypted message portal activity logs only capture events for external recipients by accessing the encrypted message portals. Any activities in email clients triggered by external recipients aren't recorded. For internal recipients, see the MailItemsAccessed mailbox-auditing action in Purview Audit (Premium) - Mail items accessed logs.