Forum Discussion

Jessie_Hernandez

Brass Contributor

Mar 06, 2017

Enabling Mailbox Audit by Default

Is there a way of turning on mailbox auditing by default in Exchange Online for newly created mailboxes? It appears that this would be feasable via the "Set-mailboxplan" cmdlet but the actual parame...

Exchange Online

Iron Contributor

Hi,

Apart from the methods of manually/scheduled/script enabling auditing on new mailboxes, has the "Set-MailboxPlan" or any other Default/Automated methods become available yet?

Copper Contributor

Feb 06, 2019

it is applied by Default now.

AndrewX
Iron Contributor
Feb 06, 2019
Yep finally, great new feature :)
- Joshua Bines
  Iron Contributor
  Aug 10, 2020
  Yes you would think that all mailboxes would be enabled with that setting but guess what? turns out they are not! Important to note: some types of mailboxes are missing which could be used as an attack vector.
  
  https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwide#supported-mailbox-types
  
  And... log shipping to the O365 unified log is also missing without that setting.
  
  https://office365itpros.com/2020/03/12/exchange-online-mailbox-auditing-default-problem/
  
  It's crazy stuff... when I first looked at this i thought just enable that and move on until I had a security assessment which still recommended enabling the setting on all mailbox in the tenant.

Share

Resources