User mailbox auditing is enabled with required actions

​

What this check verifies

Microsoft 365 Exchange Online user mailboxes have auditing enabled, include a defined set of actions for Owner, Delegate, and Admin, and retain audit records for at least the configured baseline (default 90 days).

​

Risk

Incomplete or short-retained mailbox audits degrade confidentiality and integrity.

• Untracked SendAs, inbox rule changes, and deletions enable covert access and data loss
• Narrow log windows create blind spots, delaying detection and hindering forensics and eDiscovery

​

Recommendation

Standardize mailbox auditing on all user mailboxes. Log critical actions for Owner, Delegate, and Admin (e.g., SendAs, UpdateInboxRules, HardDelete, MailboxLogin). Set AuditLogAgeLimit to meet policy ( baseline). Apply least privilege for delegates, avoid audit bypass, and regularly review or forward logs to monitoring.

​

Remediation

CLI Get-EXOMailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Set-Mailbox -AuditEnabled $true -AuditLogAgeLimit 90 -AuditAdmin @(‘ApplyRecord’,‘Copy’,‘Create’,‘FolderBind’,‘HardDelete’,‘Move’,‘MoveToDeletedItems’,‘SendAs’,‘SendOnBehalf’,‘SoftDelete’,‘Update’,‘UpdateCalendarDelegation’,‘UpdateFolderPermissions’,‘UpdateInboxRules’) -AuditDelegate @(‘ApplyRecord’,‘Create’,‘FolderBind’,‘HardDelete’,‘Move’,‘MoveToDeletedItems’,‘SendAs’,‘SendOnBehalf’,‘SoftDelete’,‘Update’,‘UpdateFolderPermissions’,‘UpdateInboxRules’) -AuditOwner @(‘ApplyRecord’,‘Create’,‘HardDelete’,‘MailboxLogin’,‘Move’,‘MoveToDeletedItems’,‘SoftDelete’,‘Update’,‘UpdateCalendarDelegation’,‘UpdateFolderPermissions’,‘UpdateInboxRules’)

​

References

• https://learn.microsoft.com/en-us/purview/audit-mailboxes?view=o365-worldwide
• https://o365info.com/mailbox-audit-powershell-microsoft-365/

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_user_mailbox_auditing_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks