Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
exchange_organization_mailbox_auditing_enabledProvider: Microsoft 365
Service:
exchangeSeverity: HIGH
Categories:
logging, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Exchange Online organization settingAuditDisabled controls tenant-wide mailbox auditing. This evaluates whether it is False so default audit events are recorded for owner, delegate, and admin across all mailboxes, taking precedence over per-mailbox settings.
Risk
Disabling tenant-wide auditing lets mailbox activity go unrecorded. Adversaries or insiders could exfiltrate data, alter or delete messages, or send as users without trace, undermining confidentiality, integrity, and effective incident response.Recommendation
EnsureAuditDisabled=False to keep mailbox auditing on by default.
- Apply least privilege and minimize audit bypass
- Define retention and review audit logs
- Alert on risky actions (e.g., hard delete, rule changes)
- Layer with defense in depth for email access
Remediation
- CLI
- Dashboard steps
Set-OrganizationConfig -AuditDisabled $false
References
- https://o365reports.com/2020/01/21/enable-mailbox-auditing-in-office-365-powershell/
- https://learn.microsoft.com/en-us/purview/audit-mailboxes?view=o365-worldwide
- https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps#-auditdisabled
- https://techcommunity.microsoft.com/blog/microsoft-security-blog/exchange-online-mailbox-auditing-enabled-by-default/361324
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = exchange_organization_mailbox_auditing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks