Enable Audit Premium events for all users

Description

Every user mailbox is licensed for Microsoft Purview Audit (Premium) and records the intelligent audit events:

• MailItemsAccessed and Send (recorded by default for licensed mailboxes when mailbox audit is on, CB-M365-AUDIT-005);
• SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint, which must be added to the owner audit actions of each mailbox (SearchQueryInitiated).

Rationale

In mail compromise cases, including state-sponsored intrusions into cloud mailboxes, the key question is which messages were read and what the attacker searched for. These events answer it and also help limit regulatory notification to the data actually accessed. Without them, the organization must assume that the whole mailbox was exposed.

Impact

Requires an Audit Premium licence (E5, E5 Compliance or the eDiscovery and Audit add-on) for each user. Search events increase audit volume. Since 2024 Microsoft also records MailItemsAccessed and Send for Audit Standard customers; this control remains useful for search events and longer native retention.

Applies when

Requires: Microsoft Purview E5 Compliance

Audit

1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global Reader and check under Billing > Licenses that every user mailbox holds a licence that includes Microsoft Purview Audit (Premium).
2. In Exchange Online PowerShell (View-Only Organization Management), check owner audit actions: Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Where-Object { $_.AuditOwner -notcontains 'MailItemsAccessed' -or $_.AuditOwner -notcontains 'SearchQueryInitiated' } | Select-Object UserPrincipalName,AuditOwner.
3. In the Microsoft Purview portal, run an Audit search for the activities Accessed mailbox items and Performed email search over the last week and check that results exist.
4. Fail if user mailboxes lack the licence, or if any licensed mailbox does not record MailItemsAccessed or SearchQueryInitiated.

Remediation

1. Assign a licence that includes Audit Premium to all users (group-based licensing is recommended).
2. Make sure mailbox audit is on (CB-M365-AUDIT-005).
3. In Exchange Online PowerShell (Organization Management or Audit Logs role), add the search action to every user mailbox: Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Set-Mailbox -AuditOwner @{Add='SearchQueryInitiated'}.
4. If MailItemsAccessed was removed from a mailbox, add it back the same way for AuditOwner, AuditDelegate and AuditAdmin.
5. Repeat step 3 for new mailboxes, for example in the provisioning process.

Rollback

Set-Mailbox -AuditOwner @{Remove='SearchQueryInitiated'}.

References

• Microsoft Purview Audit (Premium) Microsoft, vendor-doc, accessed 2026-10-24
• Set up Microsoft Purview Audit (Premium) Microsoft, vendor-doc, accessed 2026-10-24
• Set-Mailbox Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUDIT-001 Turn on the unified audit log
• related CB-M365-AUDIT-003 Retain Microsoft 365 audit logs long enough for investigations
• requires CB-M365-AUDIT-005 Keep mailbox auditing on by default for the organization
• related CB-M365-AUDIT-006 Audit owner, delegate and administrator actions on every mailbox

People and lifecycle