{
  "id": "CB-M365-AUDIT-005",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-005",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-005.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-005.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-005",
    "title": "Keep mailbox auditing on by default for the organization",
    "finding": {
      "title": "Mailbox auditing is turned off at the organization level",
      "description": "With AuditDisabled set to True, no mailbox records owner, delegate or administrator actions, whatever its own settings say."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "exchange",
      "mailbox-audit"
    ],
    "description": "Mailbox auditing on by default is in effect for the organization: `AuditDisabled` is `False` in\nthe Exchange Online organization configuration, so every user, shared and resource mailbox\nrecords the default audit actions and sends them to the unified audit log.\n",
    "rationale": "Mailbox audit records are the evidence of what happened inside a mailbox: messages moved or\ndeleted, inbox rules created, delegate access, messages sent as another user. An attacker or an\nadministrator can turn auditing off for the whole organization with one command; this setting\noverrides the `AuditEnabled` value of each mailbox.\n",
    "impact": "None known. This is the Microsoft default.\n",
    "setting": {
      "location": "Exchange Online PowerShell, Get-OrganizationConfig AuditDisabled",
      "default_value": "False",
      "recommended_value": "False"
    },
    "audit": {
      "manual": "1. Connect to Exchange Online PowerShell as at least a member of View-Only Organization\n   Management (or Global Reader).\n2. Run `Get-OrganizationConfig | Format-List AuditDisabled`.\n3. Fail if `AuditDisabled` is `True`.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell with the Organization Management role (or Audit Logs\n   role).\n2. Run `Set-OrganizationConfig -AuditDisabled $false`.\n3. Alert on any later change (audit operation `Set-OrganizationConfig` with the `AuditDisabled`\n   parameter).\n",
      "rollback": "Not recommended. `Set-OrganizationConfig -AuditDisabled $true` stops mailbox auditing for the\nwhole organization.\n"
    },
    "references": [
      {
        "title": "Manage mailbox auditing",
        "url": "https://learn.microsoft.com/purview/audit-mailboxes",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OrganizationConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-organizationconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Exchange Online baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.13.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.008"
      },
      {
        "framework": "mitre-attack",
        "id": "T1114.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-006",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-007",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}