Detections
Analytics
MS.EXO.13.1v1 - Mailbox auditing SHALL be enabled.
Information
Exchange Online user accounts can be compromised or misused. Enabling mailbox auditing provides a valuable source of information to detect and respond to mailbox misuse.Solution
Mailbox auditing can be managed from the Exchange Online PowerShell.Follow the instructions listed on [Manage mailbox auditing in Office
365](https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-mailboxes?view=o365-worldwide).
To check the current mailbox auditing status for your organization via PowerShell:
1. Connect to the Exchange Online PowerShell.
2. Run the following command:
`Get-OrganizationConfig \| Format-List AuditDisabled`
3. An `AuditDisabled : False` result indicates mailbox auditing is enabled.
To enable mailbox auditing by default for your organization via PowerShell:
1. Connect to the Exchange Online PowerShell.
2. Run the following command:
`Set-OrganizationConfig -AuditDisabled $false`
See Also
Item Details
Audit Name: CISA SCuBA Microsoft 365 Exchange Online v1.8.0
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-12c.
Plugin: microsoft_azure
Control ID: c0b0aeec92401582b68437a7f9241a3df6dc3320f5ea0ea2b8de1fed8cf0e8bd