Keep mailbox auditing on by default for the organization

Description

Mailbox auditing on by default is in effect for the organization: AuditDisabled is False in the Exchange Online organization configuration, so every user, shared and resource mailbox records the default audit actions and sends them to the unified audit log.

Rationale

Mailbox audit records are the evidence of what happened inside a mailbox: messages moved or deleted, inbox rules created, delegate access, messages sent as another user. An attacker or an administrator can turn auditing off for the whole organization with one command; this setting overrides the AuditEnabled value of each mailbox.

Impact

None known. This is the Microsoft default.

Setting

Audit

1. Connect to Exchange Online PowerShell as at least a member of View-Only Organization Management (or Global Reader).
2. Run Get-OrganizationConfig | Format-List AuditDisabled.
3. Fail if AuditDisabled is True.

Remediation

1. Connect to Exchange Online PowerShell with the Organization Management role (or Audit Logs role).
2. Run Set-OrganizationConfig -AuditDisabled $false.
3. Alert on any later change (audit operation Set-OrganizationConfig with the AuditDisabled parameter).

Rollback

Not recommended. Set-OrganizationConfig -AuditDisabled $true stops mailbox auditing for the whole organization.

References

• Manage mailbox auditing Microsoft, vendor-doc, accessed 2026-10-24
• Set-OrganizationConfig Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUDIT-004 Enable Audit Premium events for all users
• related CB-M365-AUDIT-006 Audit owner, delegate and administrator actions on every mailbox
• related CB-M365-AUDIT-007 Do not exempt any account from mailbox auditing

People and lifecycle