How to disable Office 365 mailbox audit

[Peter Farrer]

I have one Exchange office 365 email which is set as an Administrator.

I move an email from one folder to another in outlook and the activity is logged after 5 minutes

I now stop the audit

Set-Mailbox -Identity "my alias" -AuditEnabled $false

 But the audits keep on coming, I also cannot remove the audits by setting the audit time limit

Set-Mailbox -Identity "my alias" -AuditLogAgeLimit 00:00:00

I am using the Audit log search tool in the security and compliance area.

[#2 · Accepted solution]

Does it still show as Enabled? You can always open a support case to get this investigated.

[#3]

Also, how long did you wait after you turned it off? Sometimes turning something off (or on) in Office365 can take hours to take affect.

[#4]

Hi Vasil, Shows disabled.

[#5]

Yes waited all night and more on one occasion. Thanks.

[#6]

Support resynched something. Tested OK, but need to wait 24hours to make sure.

Support excellent by the way.

Thanks

[#7]

The problem could be that the change you made to the mailbox properties did not replicate to the domain controllers serving the server that hosted the active copy of the mailbox for a little time. That's the reason why (even on-premises) you often see warnings that a change might not be effective for up to 60 minutes... But there are other complicating factors as well, all of which you can and should expect inside an infrastructrure as massive and as complex as Office 365.

[#8]

You are correct I wait for 24 hours and all is well. One needs to be patient with this for it to function correctly.