Last updated on Apr 4, 2019

How to verify if Mailbox Auditing is enabled by Default on your Office 365 Tenant

Started from January 2019, Microsoft turned on mailbox auditing by default for all Microsoft 365 organizations. This means that the certain actions like the following will be logged and can be viewed in the mailbox audit log.

• Mailbox owner
• Delegates
• Administrators

Here are some benefits of mailbox auditing on by default:

• Auditing will be enabled by default when you create a new mailbox. You won’t have to manually enable it for new users.
• You won’t have manage the mailbox actions that are audited. A defined set of mailbox actions are audited by default for each type of logon. These logon types are Owner, Delegate, and Admin.
• New mailbox actions released by Microsoft will be audited by default. When Microsoft releases a new mailbox action (particularly ones that help protect your organization and help with forensic investigations), it will automatically be added to the list of mailbox actions audited by default. This means you don’t have to add new actions to the list of mailbox actions performed by owners, delegates, or admins.
• Ensure that you’re auditing the same actions for all mailboxes so you have a consistent mailbox auditing policy across your organization.

To verify if auditing is on by default a connection to EXO PowerShell needs to be established.

Connect to EXO and then run the below cmdlet.

Once a connection has been established, run the following to verify if Auditing is Disabled or Enabled.

A value of False indicates that mailbox auditing on by default is enabled for your organization.

To disabled default auditing for your organization run the following.

Sharing is caring!