Enabling Mailbox Audit by Default

[Jessie Hernandez]

Is there a way of turning on mailbox auditing by default in Exchange Online for newly created mailboxes?  It appears that this would be feasable via the "Set-mailboxplan" cmdlet but the actual parameter appears to be reserved for internal use according to the technet article: https://technet.microsoft.com/en-us/library/mt586788(v=exchg.160).aspx.  

Any ideas other than turning on Auditing manually everytime a mailbox is enabled?

[#2]

I have to run the Set-Mailbox -AuditEnabled $True every time we add a new mailbox so that Auditing is turned on.

[#3]

You can create a script to run each time you create a mailbox to do that.

[#4]

Any body know if we enable Mailbox Auditing how much % of storage will be used by Audit logs?

for e.g. If the Mailbox size is 100GB then once we enable Auditing how much size will be consumed by Audit logs?

[#5]

Thanks, that's what we are currently doing.  I was looking for a way to possibly skip that and let the mailboxplan actually default the parameter to True for any new mailbox.

[#6]

The storage doesnt count against the mailbox quota, it uses the RecoverableItems quota instead.

[#7]

@Vasil Michev thanks

Could you please elaborate more on the same? Recoverable data is also counted against total size of mailbox right?

[#8]

No, you have a separate quota for it:

[21:33:25][O365]# Get-Mailbox vasil | fl *quota*

ProhibitSendQuota            : 99 GB (106,300,440,576 bytes)
ProhibitSendReceiveQuota     : 100 GB (107,374,182,400 bytes)
RecoverableItemsQuota        : 30 GB (32,212,254,720 bytes)
RecoverableItemsWarningQuota : 20 GB (21,474,836,480 bytes)

Read more here: https://technet.microsoft.com/en-us/library/ee364755(v=exchg.160).aspx#RIQuotas

[#9]

I think you need to create script to run everytime you create a mailbox.

[#10]

Thank @Vasil.

My doubts are now cleared. It is time for me to enable auditing for all of our shared mailboxes.

I had not enabled auditing assuming they all are counted against mailbox size etc.

[#11]

Hi,

Apart from the methods of manually/scheduled/script enabling auditing on new mailboxes, has the "Set-MailboxPlan" or any other Default/Automated methods become available yet?

[#12]

Nope.

[#13]

it is applied by Default now.

[#14]

Yep finally, great new feature :)

[#15]

Yes you would think that all mailboxes would be enabled with that setting but guess what? turns out they are not! Important to note: some types of mailboxes are missing which could be used as an attack vector. 

https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwid...

And... log shipping to the O365 unified log is also missing without that setting. 

https://office365itpros.com/2020/03/12/exchange-online-mailbox-auditing-default-problem/

It's crazy stuff... when I first looked at this i thought just enable that and move on until I had a security assessment which still recommended enabling the setting on all mailbox in the tenant.