cirsec Baselines
Esc
Microsoft 365 tenant · Logging & monitoring

Audit owner, delegate and administrator actions on every mailbox

When it fails: Some mailboxes record fewer actions than the Microsoft default audit set. A mailbox whose audit actions were customized or reduced can let an attacker read, move or delete messages, or create forwarding rules, without a trace.

CB-M365-AUDIT-006mediumactivemanualprofile baseline

Description

Every user, shared and resource mailbox has AuditEnabled = True and records, for the Owner, Delegate and Admin logon types, at least the actions of the Microsoft default audit set. Either DefaultAuditSet lists Admin, Delegate and Owner (Microsoft manages the list and adds new actions automatically), or the custom lists contain at least these actions:

  • Owner: ApplyRecord, HardDelete, MailItemsAccessed, MoveToDeletedItems, Send, SoftDelete, Update, UpdateCalendarDelegation, UpdateFolderPermissions, UpdateInboxRules;
  • Delegate: ApplyRecord, Create, HardDelete, MailItemsAccessed, MoveToDeletedItems, SendAs, SendOnBehalf, SoftDelete, Update, UpdateFolderPermissions, UpdateInboxRules;
  • Admin: ApplyRecord, Create, HardDelete, MailItemsAccessed, MoveToDeletedItems, Send, SendAs, SendOnBehalf, SoftDelete, Update, UpdateCalendarDelegation, UpdateFolderPermissions, UpdateInboxRules.

The action lists above match the Microsoft default set at the time of writing; refer to the Microsoft documentation for the current list.

Rationale

Organization-wide auditing (CB-M365-AUDIT-005) only applies the actions configured on each mailbox. Customized lists are frozen: they do not receive new actions that Microsoft adds to the default set, and they are sometimes reduced on purpose. Owner, delegate and admin actions are needed to reconstruct a mailbox compromise.

Impact

None known when the default set is kept. Additional actions (for example SearchQueryInitiated in CB-M365-AUDIT-004) can be added on top.

Audit

  1. Connect to Exchange Online PowerShell as at least a member of View-Only Organization Management.
  2. Run Get-Mailbox -ResultSize Unlimited | Where-Object { -not $_.AuditEnabled -or ($_.DefaultAuditSet -notcontains 'Owner') -or ($_.DefaultAuditSet -notcontains 'Delegate') -or ($_.DefaultAuditSet -notcontains 'Admin') } | Select-Object UserPrincipalName,RecipientTypeDetails,AuditEnabled,DefaultAuditSet,AuditOwner,AuditDelegate,AuditAdmin.
  3. For each mailbox returned, compare AuditOwner, AuditDelegate and AuditAdmin with the lists in the description.
  4. Fail if a mailbox has AuditEnabled = False, or a customized logon type that misses one of the listed actions.

Remediation

  1. Connect to Exchange Online PowerShell with the Organization Management or Audit Logs role.
  2. Restore the Microsoft-managed default for a mailbox: Set-Mailbox -Identity <mailbox> -DefaultAuditSet Admin,Delegate,Owner.
  3. Or add the missing actions to the custom list, for example Set-Mailbox -Identity <mailbox> -AuditOwner @{Add='MailItemsAccessed','UpdateInboxRules'}.
  4. If AuditEnabled is False on a mailbox, run Set-Mailbox -Identity <mailbox> -AuditEnabled $true.

Rollback

Set the previous custom lists back with Set-Mailbox -AuditOwner, -AuditDelegate and -AuditAdmin.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AU-2related
NIST SP 800-53 Rev. 55.1.1AU-3related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1114.002
MITRE ATT&CKT1564.008

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr