Security and Compliance

[Andre Ruschel]

I have a case that involves sending an email that contains a payment document attached, based on that I have some questions about Exchange:

1) When creating a new email account it already has the logs by default, right?

2) How long are these logs maintained for 90 days or more?

3) Since the audit is not enabled by default my suggestion is that have it enabled by default, so it can be helpful to identify the records.

I’m not able to verify in the logs or the message flow the information that contains a file attached to the message.

My question is: Is there this information in the email flow or logs? How can I find it?

One final question, is there a list of IP addresses (from Microsoft) that show that the email was sent from Microsoft's servers?

[#2]

@Andre Ruschel you may refer to Microsoft 365 admin center or Microsoft 365 Compliance Policy to see some log files and monitor some activities of Exchange and other Microsoft 365 services:

https://docs.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center 

However, you will have to define policy to monitor or prevent data lose and enforce it for accounts you are looking for:

https://docs.microsoft.com/en-us/microsoft-365/compliance/protect-information 

There are many helpful information there and I recommend you try them out and you may refer to documents where I shared to learn more. 

[#3]

Thanks @Reza_Ameri-Archived 

I already checked all of these documents.

[#4]

@Andre Ruschel to answer your question, I would say it depends on your scenario, so when you create Audit or monitoring , you could set how log that monitoring stay on, while for other log files, there is no limitation and log files will remain forever unless if you close your Microsoft 365 or request for removal.