Do not exempt any account from mailbox auditing

Description

No user or computer account has AuditBypassEnabled = True in the mailbox audit bypass associations. Access by service accounts (backup, archiving, migration tools) is logged like any other access.

Rationale

Audit bypass was designed to reduce log volume from trusted service accounts, but it creates a blind spot: if such an account or its credentials are compromised, mailbox access through it leaves no trace. Attackers who reach administrator rights can also add a bypass to hide their own activity.

Impact

Mailbox access by backup or archiving products is recorded, which increases audit volume.

Audit

1. Connect to Exchange Online PowerShell as at least a member of View-Only Organization Management.
2. Run Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled } | Select-Object Name,AuditBypassEnabled.
3. Fail if any result is returned.

Remediation

1. Connect to Exchange Online PowerShell with the Organization Management or Audit Logs role.
2. For each account returned, run Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $false.
3. Alert on any later use of Set-MailboxAuditBypassAssociation in the unified audit log.

Rollback

Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $true (not recommended).

References

• Get-MailboxAuditBypassAssociation Microsoft, vendor-doc, accessed 2026-10-24
• Set-MailboxAuditBypassAssociation Microsoft, vendor-doc, accessed 2026-10-24
• Manage mailbox auditing Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUDIT-005 Keep mailbox auditing on by default for the organization

People and lifecycle