Mailbox Import-Export Graph APIs Leave No Audit Trail

A recent post revealed that the Mailbox Import-Export Graph API doesn’t capture audit events for its operations. The API is in beta, but this is disappointing. Auditing any mailbox is important, but it becomes a critical requirement when the possibility exists that attackers could use the API to exfiltrate mailbox data outside of the tenant. This is a hole that Microsoft needs to close.

https://office365itpros.com/2025/06/04/import-export-graph-api/