enabled mailbox auditing for all mailbox

%3CLINGO-SUB%20id%3D%22lingo-sub-836158%22%20slang%3D%22en-US%22%3Eenabled%20mailbox%20auditing%20for%20all%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-836158%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20every%20one%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20trying%20to%20enabled%20mailbox%20auditing%20for%20all%20mailbox%20in%20office%20365%20by%20running%20the%20script%3C%2FP%3E%3CH2%20id%3D%22toc-hId-1819306489%22%20id%3D%22toc-hId-1819308252%22%20id%3D%22toc-hId-1819308252%22%3E%3CSTRONG%3EEnableMailboxAuditing.ps1%3C%2FSTRONG%3E%3C%2FH2%3E%3CP%3E%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FOfficeDev%2FO365-InvestigationTooling%2Fblob%2Fmaster%2FEnableMailboxAuditing.ps1%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FOfficeDev%2FO365-InvestigationTooling%2Fblob%2Fmaster%2FEnableMailboxAuditing.ps1%3C%2FA%3E%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBut%20I%20encountered%20some%20issue...%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20I%20log%20in%20with%20my%20administrator%20account%20it%20does%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F130042i9245583C66C679F4%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnd%20when%20I%20try%20with%20my%20normal%20user%20it%20does%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F130043i4A9E3A08A3B03769%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_1.png%22%20title%3D%22clipboard_image_1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20am%20I%20doing%20wrong%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-836158%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAudit%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-837013%22%20slang%3D%22en-US%22%3ERe%3A%20enabled%20mailbox%20auditing%20for%20all%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-837013%22%20slang%3D%22en-US%22%3E%3CP%3ESeems%20like%20a%20duplicate%20threat%2C%20but%20I'll%20paste%20the%20link%20to%20the%20documentation%20here%20as%20well%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice365%2Fsecuritycompliance%2Fenable-mailbox-auditing%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnd%20the%20error%20you%20are%20getting%20in%20the%20first%20screenshot%20is%20most%20likely%20because%20you%20have%20MFA%20enabled%20(and%20you%20*should*%20have%20MFA%20enabled%20on%20any%20admin%20account).%20Meaning%20you%20need%20to%20run%20the%20MFA-enabled%20ExO%20PowerShell%20module%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fexchange%2Fexchange-online%2Fconnect-to-exchange-online-powershell%2Fmfa-connect-to-exchange-online-powershell%3Fview%3Dexchange-ps%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fexchange%2Fexchange-online%2Fconnect-to-exchange-online-powershell%2Fmfa-connect-to-exchange-online-powershell%3Fview%3Dexchange-ps%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hello every one,

 

I am trying to enabled mailbox auditing for all mailbox in office 365 by running the script

EnableMailboxAuditing.ps1

https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/EnableMailboxAuditing.ps1

 

But I encountered some issue...

 

When I log in with my administrator account it does the following:

 

clipboard_image_0.png

 

And when I try with my normal user it does the following:

 

clipboard_image_1.png

 

What am I doing wrong?

 

1 Reply

Seems like a duplicate threat, but I'll paste the link to the documentation here as well: https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing

 

And the error you are getting in the first screenshot is most likely because you have MFA enabled (and you *should* have MFA enabled on any admin account). Meaning you need to run the MFA-enabled ExO PowerShell module: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powe...