What this check looks at
Checks that no account is set to bypass mailbox audit logging.
Exchange Online can exempt an account from mailbox audit logging with an audit bypass association (Set-MailboxAuditBypassAssociation -AuditBypassEnabled $true). Whatever that account then does in any mailbox, such as opening folders, reading, moving or deleting messages, is not recorded at all. It was meant for high-volume service accounts such as backup and archiving products, to keep audit logs small; nothing sets it by default.
The check lists every audit bypass association and fails when any account has bypass enabled, naming up to three in the summary and every one in the evidence. It passes when no account bypasses mailbox audit logging.
A bypassed account is invisible in exactly the logs an investigation relies on. If it also has Full Access to many mailboxes, as backup service accounts often do, anyone who obtains its credentials can read the whole organisation’s mail without trace. An attacker with Exchange administrator rights can also set bypass on an account they control to hide their own activity.
Why it matters
An account with audit bypass can open and read any mailbox it has access to without a single record. Attackers who find one, often a forgotten backup or archiving service account, use it precisely because it leaves no trace.
After a breach at a 120-person firm, the investigator finds a backup service account set to bypass auditing years ago, with Full Access to every mailbox and a password that was never changed. The sign-in logs show it was used from an unfamiliar IP address, but there is no record of what it opened, so the firm has to assume every mailbox was read.
That assumption is expensive. Under UK GDPR, a breach whose scope cannot be established is usually treated as affecting everyone, with notifications to the ICO and possibly to every customer and employee whose data sits in mail. Turning bypass off costs nothing; at most a backup product generates more audit records.
CIS Microsoft 365 Foundations Benchmark 6.1.3 asks that AuditBypassEnabled is not enabled on mailboxes. ISO 27001 A.8.15 (logging), NIST CSF 2.0 PR.PS-04, CIS Controls v8 8.2 and NCSC CAF C1.a and C1.b (monitoring coverage, securing logs) all expect logging that cannot be quietly switched off for some accounts.
How to fix it
Before you start
- Ask the vendor of any backup or archiving product that uses the account whether it still needs audit bypass; current versions normally do not.
Step by step
- List the bypassed accounts. Connect with Connect-ExchangeOnline and run Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled | Format-Table Name, AuditBypassEnabled. The result should match the accounts in the evidence.
- Find out why each was set. For each account, establish what it is: a backup or archiving product, a migration tool, an old service account. Ask the vendor whether the current version still needs bypass; most do not. In the Microsoft Purview portal, search Solutions > Audit for the Set-MailboxAuditBypassAssociation activity to see who set it and when, if that is within the audit retention period.
- Treat an unexplained bypass as an incident. If nobody can explain an account’s bypass, or it belongs to a person rather than a service, treat it as a possible compromise: review the account’s sign-ins in the Microsoft Entra admin centre (Entra ID > Monitoring & health > Sign-in logs), the mailboxes it has Full Access to, and any admin roles it holds.
- Turn bypass off. Run Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $false for each account, or all at once with Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled | Set-MailboxAuditBypassAssociation -AuditBypassEnabled $false.
- Reduce what the service account can reach. While you are there, check the service account still needs every mailbox permission it holds, remove the ones it does not, and give it a long random password, or move it to the app-based connection its vendor now supports.
- Confirm nothing bypasses auditing. Run Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled and check it returns nothing. The next assessment passes.
With PowerShell
Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled | Set-MailboxAuditBypassAssociation -AuditBypassEnabled $false
What users will notice
None. Actions by the listed accounts are recorded in the mailbox audit log.
How to confirm it worked
Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled returns nothing.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.a Monitoring coverageC1.b Securing logs |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-3 Enable logging for security investigation |
| Zero Trust | Visibility, automation and orchestration |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| PCI DSS 4.0.1 | 10.2.1 Audit logs are enabled and active |
| NIST SP 800-171 | 3.3.1 Create and retain system audit logs and records3.3.2 Ensure the actions of individual users can be traced |
| CMMC Level 2 | AU.L2-3.3.1 System AuditingAU.L2-3.3.2 User Accountability |
| ISO 27001:2022 | A.8.15 Logging |
| CIS M365 | 6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes |
| CIS Controls v8.1 | 8.2 Collect audit logs (IG1) |
| NIST CSF 2.0 | PR.PS-04: Log records are generated and made available for continuous monitoring |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-MailboxAuditBypassAssociation (Microsoft Learn)