Enable the MailItemsAccessed Event for Exchange Online Mailboxes

Recent details released about the Storm-0558 attack on sensitive U.S. agencies revealed the importance of the MailItemsAccessed event for forensic investigations. Luckily, after Microsoft was a tad embarrassed by the recent Storm-0558 attack, tenants with Office 365 E3 or Microsoft 365 E3 licenses can capture the MailItemsAccessed event for mailboxes without having to pay for Microsoft Purview Audit Premium. But you might have to do a little work to ensure that the right audit configuration is used for all mailboxes.

https://office365itpros.com/2023/09/11/mailitemsaccessed-event-important/