Check ID: exchange_mailbox_audit_bypass_disabled
Provider: Microsoft 365
Service: exchange
Severity: HIGH
Categories: logging, forensics-ready, e3
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Exchange Online mailboxes are evaluated for audit logging bypass by reviewing the AuditBypassEnabled setting and identifying mailboxes where auditing can be circumvented.

​
Risk

Bypassed mailbox auditing removes visibility into access and actions, weakening detective controls. Covert data exfiltration, inbox-rule abuse, and persistence become harder to spot, harming confidentiality and integrity and impeding forensics.

​
Recommendation

Disable audit bypass by keeping AuditBypassEnabled set to false for all accounts. Apply least privilege to service identities, use dedicated accounts for automation, and monitor for bypass associations with alerts. Enforce separation of duties and preserve tamper-resistant audit logs.

​
Remediation

Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where-Object {$_.AuditBypassEnabled} | ForEach-Object { Set-MailboxAuditBypassAssociation -Identity $_.Identity -AuditBypassEnabled $false }

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_mailbox_audit_bypass_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks