Exchange Online mailbox auditing has been enhanced to provide visibility into a specific audit evasion technique that has been observed in security investigations. This post explains the change, why it was introduced, and how administrators and security investigators can query for the new audit records.
Background: IPM vs. Non-IPM Subtree
Every Exchange Online mailbox is organized into two parts:
- IPM subtree (Interpersonal Message subtree) — the visible, user-facing part of a mailbox, designed for messages exchanged between human recipients. This includes Inbox, Sent Items, Deleted Items, Calendar, Contacts, Tasks, Notes, and any custom folders a user creates. Exchange mailbox auditing has always focused on activity within this area.
- Non-IPM subtree — a hidden folder structure used by Exchange and Microsoft services for system-level storage, such as the Recoverable Items folder. Users cannot see or directly interact with this area from most mail clients (like Outlook).
For more details, see IPM Subtree | Microsoft Learn.
The Audit Gap This Addresses
A known audit evasion technique involves copying mail items from a user's visible IPM folders into a hidden folder in the non-IPM subtree and then accessing the data from there for exfiltration. This technique has been observed in security investigations against Exchange Online.
This worked as an evasion method because:
- Copy operations are not enabled for auditing by default
- Activity in the non-IPM subtree was not audited
By staging data in the non-IPM subtree before exfiltration, this activity previously left no trace in the mailbox audit log.
What's New
Exchange Online now logs a MailItemsAccessed event whenever a mail item is copied from the IPM subtree to the non-IPM subtree.
A new AccessType value — CopyFromIPM — has been introduced to distinguish these records from existing MailItemsAccessed events, making them straightforward to query for:
|
AccessType |
Description |
|
Bind |
Existing — individual item access |
|
Sync |
Existing — bulk sync access |
|
CopyFromIPM |
New - an item in the IPM subtree was accessed to copy its content to the non-IPM subtree |
How to Query for These Records
Use the following PowerShell command to search for CopyFromIPM activity in your tenant:
Search-UnifiedAuditLog -StartDate 4/1/2026 -EndDate 4/15/2026 -FreeText "CopyFromIPM"
Understanding the CopyFromIPM Audit Record
When a CopyFromIPM event is logged, it is recorded as a MailItemsAccessed operation in the Unified Audit Log. Each record captures an individual mail item that was copied from the IPM subtree to the non-IPM subtree during the operation. When an entire folder is copied, the ItemId that is captured is the Id of the folder; individual records are not captured for each item in the folder.
Feedback
If you have any feedback about this change, you can reach out to ExchangeMailboxAudit-Support group. We are always happy to hear from you and assist in any way we can.
Microsoft