What this check looks at
Checks every user mailbox has auditing on with the actions CIS lists for administrators, delegates and the owner, including folder opening, moves and copies.
Mailbox auditing records what is done in each mailbox, split by who did it: an administrator (AuditAdmin), a delegate with access (AuditDelegate) or the owner (AuditOwner). Microsoft turns auditing on by default with a default set of actions for each, but that set leaves out actions investigators need: Copy, FolderBind and Move for administrators, FolderBind and Move for delegates, and Create, MailboxLogin and Move for the owner. Tenants without E5 may also be missing MailItemsAccessed and Send.
The check reads every user mailbox and compares its three audit lists with the actions CIS 6.1.2 lists. It fails when any user mailbox has auditing off or is missing any listed action, and passes only when every user mailbox records them all. The evidence names up to 25 mailboxes and the actions each one misses.
After a mailbox compromise the question is always what the attacker saw and did. Without FolderBind and MailItemsAccessed there is no record of which folders and messages were opened; without Move and Copy, no record of mail moved to a hidden folder or copied out. The audit log then cannot answer the question, and the organisation must assume the worst.
Why it matters
After a mailbox is compromised, the question is what the attacker read, moved and sent. Microsoft’s default audit set leaves out some of those actions; without them the answer is guesswork.
An attacker spends two weeks in the practice manager’s mailbox at a dental group. When it comes to light, the practice has to decide whether patients’ personal data was accessed. With MailItemsAccessed and FolderBind recorded, the investigator can show exactly which folders and messages were opened; without them, the practice must assume every message was read and treat it as a breach affecting everyone in the mailbox.
Under UK GDPR, a breach likely to result in a high risk to people must be reported to them as well as to the ICO, and being unable to scope a breach usually pushes the assessment towards notifying everyone. Good audit records turn a costly worst-case notification into a targeted one, and give insurers the evidence they ask for.
CIS Microsoft 365 Foundations Benchmark 6.1.2 lists these audit actions. ISO 27001 A.8.15 (logging), NIST CSF 2.0 PR.PS-04 (log records generated for monitoring), CIS Controls v8 8.2 (collect audit logs) and NCSC CAF C1.a (monitoring coverage) all expect the activity needed to investigate an incident to be recorded.
How to fix it
Before you start
- Nothing to prepare. Extra audit actions add audit records but do not affect mailbox performance.
Step by step
- Check auditing is on for the organisation. Connect with Connect-ExchangeOnline and run Get-OrganizationConfig | Format-List AuditDisabled. It must be False; if it is True, mailbox auditing is off for everyone (the separate mailbox auditing check covers this) and must be turned on first with Set-OrganizationConfig -AuditDisabled $false.
- Look at one affected mailbox. Run Get-EXOMailbox -Identity user@contoso.com -Properties AuditEnabled, AuditAdmin, AuditDelegate, AuditOwner, DefaultAuditSet | Format-List for a mailbox named in the evidence, to see what it records today and which actions are missing.
- Define the CIS action lists. In the same session set three variables: $admin = "ApplyRecord","Copy","Create","FolderBind","HardDelete","MailItemsAccessed","Move","MoveToDeletedItems","SendAs","SendOnBehalf","Send","SoftDelete","Update","UpdateCalendarDelegation","UpdateFolderPermissions","UpdateInboxRules"; $delegate = "ApplyRecord","Create","FolderBind","HardDelete","Move","MailItemsAccessed","MoveToDeletedItems","SendAs","SendOnBehalf","SoftDelete","Update","UpdateFolderPermissions","UpdateInboxRules"; $owner = "ApplyRecord","Create","HardDelete","MailboxLogin","Move","MailItemsAccessed","MoveToDeletedItems","Send","SoftDelete","Update","UpdateCalendarDelegation","UpdateFolderPermissions","UpdateInboxRules".
- Apply them to every user mailbox. Run Get-EXOMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | ForEach-Object { Set-Mailbox -Identity $_.UserPrincipalName -AuditEnabled $true -AuditAdmin @{Add=$admin} -AuditDelegate @{Add=$delegate} -AuditOwner @{Add=$owner} }. Adding, rather than replacing, keeps any extra actions already recorded. For a few hundred mailboxes this takes some minutes; check the output for errors at the end.
- Cover new starters. New mailboxes get Microsoft’s default set, so add the same Set-Mailbox command to the onboarding checklist or script, or run the whole loop monthly (an Azure Automation runbook works well). Once a mailbox’s actions are customised it no longer picks up actions Microsoft later adds to the default set, so review the list when CIS updates it.
- Confirm the audit lists. Re-run the command from the second step for a few mailboxes, including one from the evidence, and check each list contains every action above. The next assessment passes when every user mailbox records them all.
With PowerShell
Get-EXOMailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | Set-Mailbox -AuditEnabled $true -AuditAdmin @{Add="Copy","FolderBind","Move"} -AuditDelegate @{Add="FolderBind","Move"} -AuditOwner @{Add="Create","MailboxLogin","Move"}What users will notice
None. More mailbox activity is recorded in the audit log.
How to confirm it worked
Get-EXOMailbox -Properties AuditAdmin,AuditDelegate,AuditOwner for a sample mailbox lists every action in the CIS lists.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.a Monitoring coverage |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-3 Enable logging for security investigation |
| Zero Trust | Visibility, automation and orchestration |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| PCI DSS 4.0.1 | 10.2.1 Audit logs are enabled and active |
| NIST SP 800-171 | 3.3.1 Create and retain system audit logs and records3.3.2 Ensure the actions of individual users can be traced |
| CMMC Level 2 | AU.L2-3.3.1 System AuditingAU.L2-3.3.2 User Accountability |
| ISO 27001:2022 | A.8.15 Logging |
| CIS M365 | 6.1.2 Ensure mailbox audit actions are configured |
| CIS Controls v8.1 | 8.2 Collect audit logs (IG1) |
| NIST CSF 2.0 | PR.PS-04: Log records are generated and made available for continuous monitoring |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage mailbox auditing (Microsoft Learn)