Why Default Mailbox Auditing for Exchange Online Isn’t Quite as Good as It Seems

%3CLINGO-SUB%20id%3D%22lingo-sub-1223815%22%20slang%3D%22en-US%22%3EWhy%20Default%20Mailbox%20Auditing%20for%20Exchange%20Online%20Isn%E2%80%99t%20Quite%20as%20Good%20as%20It%20Seems%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1223815%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EExchange%20Online%20enables%20mailbox%20auditing%20by%20default%2C%20which%20should%20mean%20that%20audit%20events%20get%20to%20the%20Office%20365%20audit%20log%20for%20all%20E3%20and%20E5%20mailboxes.%20Well%2C%20that%E2%80%99s%20what%20you%20might%20thing%20but%20that%E2%80%99s%20not%20what%20happens.%20Mailbox%20events%20for%20E5%20mailboxes%20arrive%20just%20fine%2C%20but%20you%20must%20reenable%20E3%20mailboxes%20for%20auditing%20before%20their%20events%20flow.%20It%E2%80%99s%20a%20bizarre%20situation.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Foffice365itpros.com%2F2020%2F03%2F12%2Fexchange-online-mailbox-auditing-default-problem%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Foffice365itpros.com%2F2020%2F03%2F12%2Fexchange-online-mailbox-auditing-default-problem%2F%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1223815%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1224124%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20Default%20Mailbox%20Auditing%20for%20Exchange%20Online%20Isn%E2%80%99t%20Quite%20as%20Good%20as%20It%20Seems%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1224124%22%20slang%3D%22en-US%22%3E%3CP%3EWait%2C%20what%3F!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1231392%22%20slang%3D%22en-US%22%3ERe%3A%20Why%20Default%20Mailbox%20Auditing%20for%20Exchange%20Online%20Isn%E2%80%99t%20Quite%20as%20Good%20as%20It%20Seems%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1231392%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20will%20surely%20give%20some%20nightmares%20to%20Admin%20once%20they%20see%20this%20Post%20%3Ap%3C%2Fimg%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F64%22%20target%3D%22_blank%22%3E%40Tony%20Redmond%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
MVP

 

Exchange Online enables mailbox auditing by default, which should mean that audit events get to the Office 365 audit log for all E3 and E5 mailboxes. Well, that’s what you might thing but that’s not what happens. Mailbox events for E5 mailboxes arrive just fine, but you must reenable E3 mailboxes for auditing before their events flow. It’s a bizarre situation.

 

https://office365itpros.com/2020/03/12/exchange-online-mailbox-auditing-default-problem/

2 Replies
Highlighted
Highlighted

This will surely give some nightmares to Admin once they see this Post :p 

 

@Tony Redmond