Detections
Analytics

6.1.1 (L1) Ensure 'AuditDisabled' organizationally is set to 'False'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The value False indicates that mailbox auditing on by default is turned on for the organization. Mailbox auditing on by default in the organization overrides the mailbox auditing settings on individual mailboxes. For example, if mailbox auditing is turned off for a mailbox (the AuditEnabled property on the mailbox is False), the default mailbox actions are still audited for the mailbox, because mailbox auditing on by default is turned on for the organization.

Turning off mailbox auditing on by default ($true) has the following results:

 - Mailbox auditing is turned off for your organization.
 - From the time you turn off mailbox auditing on by default, no mailbox actions are audited, even if mailbox auditing is enabled on a mailbox (the AuditEnabled property on the mailbox is True).
 - Mailbox auditing isn't turned on for new mailboxes and setting the AuditEnabled property on a new or existing mailbox to True is ignored.
 - Any mailbox audit bypass association settings (configured by using the Set-MailboxAuditBypassAssociation cmdlet) are ignored.
 - Existing mailbox audit records are retained until the audit log age limit for the record expires.

The recommended state for this setting is False at the organization level. This will enable auditing and enforce the default.

Enforcing the default ensures auditing was not turned off intentionally or accidentally. Auditing mailbox actions will allow forensics and IR teams to trace various malicious activities that can generate TTPs caused by inbox access and tampering.

Note: Without advanced auditing (E5 function) the logs are limited to 90 days.

Solution

To remediate using PowerShell:

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following PowerShell command:

Set-OrganizationConfig -AuditDisabled $false

Impact:

None - this is the default behavior as of 2019.

See Also

https://workbench.cisecurity.org/benchmarks/22162

Item Details

References: CSCv7|6.2

Plugin: microsoft_azure

Control ID: 2b9b4fc78ac62a8758db032ad2033354fdc8839fdf717d9cdae9ca9bb3e31573