M365EXO-009: Mailbox auditing enabled
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Mailbox auditing records actions performed on mailbox contents by the mailbox owner, delegates, and administrators, providing critical forensic evidence during security investigations. Although mailbox auditing is enabled by default in Microsoft 365, organizations may have disabled it for specific mailboxes or may not have verified that the default audit actions are sufficient. Without mailbox auditing, unauthorized mailbox access and data exfiltration cannot be detected or investigated.
Recommended value
Mailbox auditing enabled for all mailboxes; default audit actions include MailItemsAccessed, Send, and SoftDelete for all logon types
Remediation
Verify that mailbox auditing is enabled organization-wide by checking that the AuditDisabled parameter is set to False on all mailboxes. Review the audited actions for each logon type (Owner, Delegate, Admin) and ensure that critical actions such as MailItemsAccessed, Send, SoftDelete, HardDelete, and UpdateFolderPermissions are being recorded. For mailboxes that have audit disabled, re-enable auditing and investigate why it was disabled to rule out malicious tampering.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.EXO.13.1v1
- NIST SP 800-53
- AU-2, AU-3
- CIS M365 Benchmark
- 3.1.1