{
  "id": "CB-M365-AUDIT-006",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-006",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-006.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-006.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-006",
    "title": "Audit owner, delegate and administrator actions on every mailbox",
    "finding": {
      "title": "Some mailboxes record fewer actions than the Microsoft default audit set",
      "description": "A mailbox whose audit actions were customized or reduced can let an attacker read, move or delete messages, or create forwarding rules, without a trace."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "exchange",
      "mailbox-audit"
    ],
    "description": "Every user, shared and resource mailbox has `AuditEnabled` = `True` and records, for the\n**Owner**, **Delegate** and **Admin** logon types, at least the actions of the Microsoft default\naudit set. Either `DefaultAuditSet` lists `Admin`, `Delegate` and `Owner` (Microsoft manages the\nlist and adds new actions automatically), or the custom lists contain at least these actions:\n\n- Owner: `ApplyRecord`, `HardDelete`, `MailItemsAccessed`, `MoveToDeletedItems`, `Send`,\n  `SoftDelete`, `Update`, `UpdateCalendarDelegation`, `UpdateFolderPermissions`,\n  `UpdateInboxRules`;\n- Delegate: `ApplyRecord`, `Create`, `HardDelete`, `MailItemsAccessed`, `MoveToDeletedItems`,\n  `SendAs`, `SendOnBehalf`, `SoftDelete`, `Update`, `UpdateFolderPermissions`, `UpdateInboxRules`;\n- Admin: `ApplyRecord`, `Create`, `HardDelete`, `MailItemsAccessed`, `MoveToDeletedItems`,\n  `Send`, `SendAs`, `SendOnBehalf`, `SoftDelete`, `Update`, `UpdateCalendarDelegation`,\n  `UpdateFolderPermissions`, `UpdateInboxRules`.\n",
    "rationale": "Organization-wide auditing (CB-M365-AUDIT-005) only applies the actions configured on each\nmailbox. Customized lists are frozen: they do not receive new actions that Microsoft adds to the\ndefault set, and they are sometimes reduced on purpose. Owner, delegate and admin actions are\nneeded to reconstruct a mailbox compromise.\n",
    "impact": "None known when the default set is kept. Additional actions (for example `SearchQueryInitiated`\nin CB-M365-AUDIT-004) can be added on top.\n",
    "notes": "The action lists above match the Microsoft default set at the time of writing; refer to the\nMicrosoft documentation for the current list.\n",
    "audit": {
      "manual": "1. Connect to Exchange Online PowerShell as at least a member of View-Only Organization\n   Management.\n2. Run `Get-Mailbox -ResultSize Unlimited | Where-Object { -not $_.AuditEnabled -or ($_.DefaultAuditSet -notcontains 'Owner') -or ($_.DefaultAuditSet -notcontains 'Delegate') -or ($_.DefaultAuditSet -notcontains 'Admin') } | Select-Object UserPrincipalName,RecipientTypeDetails,AuditEnabled,DefaultAuditSet,AuditOwner,AuditDelegate,AuditAdmin`.\n3. For each mailbox returned, compare `AuditOwner`, `AuditDelegate` and `AuditAdmin` with the\n   lists in the description.\n4. Fail if a mailbox has `AuditEnabled` = `False`, or a customized logon type that misses one of\n   the listed actions.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell with the Organization Management or Audit Logs role.\n2. Restore the Microsoft-managed default for a mailbox:\n   `Set-Mailbox -Identity <mailbox> -DefaultAuditSet Admin,Delegate,Owner`.\n3. Or add the missing actions to the custom list, for example\n   `Set-Mailbox -Identity <mailbox> -AuditOwner @{Add='MailItemsAccessed','UpdateInboxRules'}`.\n4. If `AuditEnabled` is `False` on a mailbox, run `Set-Mailbox -Identity <mailbox> -AuditEnabled $true`.\n",
      "rollback": "Set the previous custom lists back with `Set-Mailbox -AuditOwner`, `-AuditDelegate` and\n`-AuditAdmin`.\n"
    },
    "references": [
      {
        "title": "Manage mailbox auditing",
        "url": "https://learn.microsoft.com/purview/audit-mailboxes",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Get-Mailbox",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/get-mailbox",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1114.002"
      },
      {
        "framework": "mitre-attack",
        "id": "T1564.008"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-005",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUDIT-004",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}