What this check looks at
Checks, from Microsoft Secure Score, that mailbox auditing is on, so mailbox access and actions are recorded.
Mailbox auditing records actions taken in mailboxes by the owner, delegates and administrators: messages sent, deleted and moved, inbox rules created, permissions changed and, through MailItemsAccessed, which messages were opened or synced. Microsoft turns it on by default for every organisation, controlled by AuditDisabled in the organisation configuration (Get-OrganizationConfig); it is off only if someone sets AuditDisabled to True. Individual mailboxes can also be exempted with an audit bypass association.
The check reads AuditDisabled directly from Exchange Online where it can: False passes and True fails. Without that, it uses Microsoft Secure Score’s mailbox auditing action and fails if it is not done, and it reports not checked when neither is available. It does not read bypass associations, so check those by hand (a step below).
Mailbox audit records are what show, after a business email compromise, which messages the attacker opened, what they sent, which inbox rules they created to hide replies and whether they deleted evidence. With auditing disabled those questions have no answer, and an attacker who reaches administrator rights may switch it off, or bypass one mailbox, to cover their tracks.
Why it matters
After a business email compromise, the first question is which messages the attacker read, sent and deleted. Mailbox auditing is what answers it, and what an insurer’s incident responders will ask for.
A typical case: a conveyancing firm’s mailbox is compromised and a client is sent fake completion bank details. To decide whether it must notify every client whose emails were in that mailbox, the firm needs the MailItemsAccessed records showing which messages the attacker opened. With mailbox auditing off it cannot tell, so it has to assume all were read and notify hundreds of clients, and the ICO.
Good mailbox audit records often shrink an incident from "everything in the mailbox" to the handful of messages actually opened, which changes the cost, the notifications and the conversation with the insurer.
CIS Microsoft 365 Foundations Benchmark 6.1.1 asks that AuditDisabled is False for the organisation, and CISA SCuBA MS.EXO.13.1v1 asks for mailbox auditing to be enabled. It supports ISO 27001 A.8.15, PCI DSS 10.2.1 and the NCSC Cyber Assessment Framework’s C1.a.
How to fix it
Before you start
- Check no mailbox has auditing bypassed (Get-MailboxAuditBypassAssociation).
Step by step
- Check the organisation setting. In Exchange Online PowerShell (Install-Module ExchangeOnlineManagement, then Connect-ExchangeOnline as an Exchange Administrator), run Get-OrganizationConfig | Format-List AuditDisabled. False means auditing is on.
- Turn auditing on for the organisation. If AuditDisabled is True, run Set-OrganizationConfig -AuditDisabled $false. If nobody can explain why it was off, treat that as a possible compromise and review who holds Exchange and Global Administrator roles.
- Find mailboxes that bypass auditing. Run Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled -eq $true } | Format-Table Name, AuditBypassEnabled. Any result means that mailbox’s actions are not recorded.
- Remove each bypass. For each one, find out why it was set, then run Set-MailboxAuditBypassAssociation -Identity "<name>" -AuditBypassEnabled $false.
- Restore default audit actions on customised mailboxes. Run Get-Mailbox -ResultSize Unlimited | Where-Object { $_.DefaultAuditSet.Count -lt 3 } | Select-Object Name, DefaultAuditSet to find mailboxes whose audit actions were customised, and put Microsoft’s defaults back with Set-Mailbox -Identity "<name>" -DefaultAuditSet Admin,Delegate,Owner.
- Confirm the change. Get-OrganizationConfig shows AuditDisabled False, the bypass query returns nothing, and Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -RecordType ExchangeItem -ResultSize 10 returns recent mailbox activity.
With PowerShell
Connect-ExchangeOnline Set-OrganizationConfig -AuditDisabled $false
What users will notice
None.
How to confirm it worked
Get-OrganizationConfig shows AuditDisabled as False, and no bypass associations are returned.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.a Monitoring coverage |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-3 Enable logging for security investigation |
| Zero Trust | Visibility, automation and orchestration |
| Secure Score | Ensure mailbox auditing is on |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| PCI DSS 4.0.1 | 10.2.1 Audit logs are enabled and active |
| NIST SP 800-171 | 3.3.1 Create and retain system audit logs and records3.3.2 Ensure the actions of individual users can be traced |
| CMMC Level 2 | AU.L2-3.3.1 System AuditingAU.L2-3.3.2 User Accountability |
| ISO 27001:2022 | A.8.15 Logging |
| CISA SCuBA | MS.EXO.13.1v1 Mailbox auditing enabled |
| CIS M365 | 6.1.1 Ensure 'AuditDisabled' organisationally is set to 'False' |
| CIS Controls v8.1 | 8.2 Collect audit logs (IG1) |
| NIST CSF 2.0 | PR.PS-04: Log records are generated and made available for continuous monitoring |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage mailbox auditing (Microsoft Learn)