{
  "id": "CB-M365-AUDIT-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-004.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-004",
    "title": "Enable Audit Premium events for all users",
    "finding": {
      "title": "Mailbox access and search events needed for incident response are not recorded for all users",
      "description": "Without Audit Premium events such as MailItemsAccessed, Send and SearchQueryInitiated, investigators cannot tell which emails an attacker read or searched for."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "audit-premium",
      "purview",
      "exchange",
      "incident-response"
    ],
    "applicability": {
      "requires": [
        "Microsoft Purview E5 Compliance"
      ]
    },
    "description": "Every user mailbox is licensed for Microsoft Purview Audit (Premium) and records the intelligent\naudit events:\n\n- `MailItemsAccessed` and `Send` (recorded by default for licensed mailboxes when mailbox audit is\n  on, CB-M365-AUDIT-005);\n- `SearchQueryInitiatedExchange` and `SearchQueryInitiatedSharePoint`, which must be added to\n  the owner audit actions of each mailbox (`SearchQueryInitiated`).\n",
    "rationale": "In mail compromise cases, including state-sponsored intrusions into cloud mailboxes, the key\nquestion is which messages were read and what the attacker searched for. These events answer it\nand also help limit regulatory notification to the data actually accessed. Without them, the\norganization must assume that the whole mailbox was exposed.\n",
    "impact": "Requires an Audit Premium licence (E5, E5 Compliance or the eDiscovery and Audit add-on) for each\nuser. Search events increase audit volume. Since 2024 Microsoft also records `MailItemsAccessed`\nand `Send` for Audit Standard customers; this control remains useful for search events and\nlonger native retention.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.microsoft.com) as at least a Global\n   Reader and check under **Billing** > **Licenses** that every user mailbox holds a licence that\n   includes Microsoft Purview Audit (Premium).\n2. In Exchange Online PowerShell (View-Only Organization Management), check owner audit actions:\n   `Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Where-Object { $_.AuditOwner -notcontains 'MailItemsAccessed' -or $_.AuditOwner -notcontains 'SearchQueryInitiated' } | Select-Object UserPrincipalName,AuditOwner`.\n3. In the Microsoft Purview portal, run an **Audit** search for the activities **Accessed mailbox\n   items** and **Performed email search** over the last week and check that results exist.\n4. Fail if user mailboxes lack the licence, or if any licensed mailbox does not record\n   `MailItemsAccessed` or `SearchQueryInitiated`.\n"
    },
    "remediation": {
      "manual": "1. Assign a licence that includes Audit Premium to all users (group-based licensing is\n   recommended).\n2. Make sure mailbox audit is on (CB-M365-AUDIT-005).\n3. In Exchange Online PowerShell (Organization Management or Audit Logs role), add the search\n   action to every user mailbox:\n   `Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Set-Mailbox -AuditOwner @{Add='SearchQueryInitiated'}`.\n4. If `MailItemsAccessed` was removed from a mailbox, add it back the same way for `AuditOwner`,\n   `AuditDelegate` and `AuditAdmin`.\n5. Repeat step 3 for new mailboxes, for example in the provisioning process.\n",
      "rollback": "`Set-Mailbox -AuditOwner @{Remove='SearchQueryInitiated'}`.\n"
    },
    "references": [
      {
        "title": "Microsoft Purview Audit (Premium)",
        "url": "https://learn.microsoft.com/purview/audit-premium",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set up Microsoft Purview Audit (Premium)",
        "url": "https://learn.microsoft.com/purview/audit-premium-setup",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-Mailbox",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-mailbox",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.DEFENDER.6.2v1",
        "relation": "equivalent",
        "note": "Policy withdrawn from SCuBA 2.0; kept in the hardened profile for incident response."
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.17.2v1",
        "relation": "equivalent",
        "note": "Policy withdrawn from SCuBA 2.0; kept in the hardened profile for incident response."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1114.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-001",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUDIT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-005",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUDIT-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}