How to Monitor Mailbox Audit Bypass Events in Exchange Online

Since January 2019, Microsoft has enabled default mailbox auditing for all organizations, which allows specific actions known as default actions, to be logged for all logon types. However, activities like mailbox logins and folder bind operations aren't audited by default and require custom configuration. Also, default auditing only covers user, shared, and group mailboxes. To track activities in resource or public folder mailboxes, you must enable auditing manually.

To maintain complete visibility and meet compliance needs, keep auditing enabled for all mailboxes unless there's a valid reason to exclude one. Note that audit settings can only be managed through PowerShell, as the Microsoft 365 admin portals don't offer this option.

Enable audit logging for a mailbox using PowerShell

In order to track key actions like message deletions, moves, sends, and folder operations, you must enable mailbox audit logging. It records all activities performed by owners, delegates, and admins with details like event time and user identity. To enable auditing on a mailbox, run the below cmdlet in PowerShell.

Before executing, ensure to connect to the Exchange Online PowerShell module.

Set-Mailbox -Identity "<user@contoso.com>" -AuditEnabled $true

This enables audit logging for the specified mailbox and begins tracking actions based on the default or customized audit logging configuration.

Disable mailbox auditing for a user using PowerShell

You can disable mailbox auditing for specific accounts, such as service or test mailboxes, when audit logs are not required. This helps reduce storage usage and keeps audit data focused on relevant activity. However, to completely stop audit logging for a mailbox, tenant-level settings must also be considered, as some audit actions may still be recorded even when auditing is disabled on the mailbox.

However, proceed with caution because disabling audit logging for a mailbox means that no further activity from that mailbox will be recorded beyond the default audit actions.

To disable audit log for a mailbox, execute the following cmdlet in Exchange Online PowerShell.

Set-Mailbox -Identity "<user@contoso.com>" -AuditEnabled $false

Run the following cmdlet to confirm whether audit logging changes have been applied to a specific mailbox.

Get-Mailbox -Identity "<user@contoso.com>" | Format-List AuditEnabled

Replace <user@contoso.com> with the email address of the mailbox you want to update.

If auditing is disabled on critical mailboxes either accidentally or intentionally, it creates blind spots in your audit trail. This can prevent timely detection of policy violations, data loss, or security breaches. That's why it's crucial to view and keep track of mailboxes with auditing disabled.

• This report helps to identify non-audited mailboxes by recipient type, location, license status, and more, to ensure no mailbox is overlooked.
• Instantly identify when audit logging is turned off for critical mailboxes such as room mailboxes, shared mailboxes, or public folder mailboxes.

Mailbox audit bypass allows you to exclude specific users from mailbox audit logging typically to reduce noise from authorized or trusted application accounts that generate high-volume, low-risk activity. Instead of disabling audit logging entirely, you can configure the mailbox for audit bypass. This disables auditing of the user's actions across all mailboxes in the tenant while still logging actions performed by others on the mailbox.

Bypass a user account from mailbox audit logging using PowerShell

To enable mailbox audit bypass for a mailbox, run the 'Set-MailboxAuditBypassAssociation' in Exchange Online PowerShell as shown below.

Set-MailboxAuditBypassAssociation –Identity "<user@contoso.com>" -AuditBypassEnabled $true

This command bypasses and stops mailbox audit logging for the specified user across all mailboxes.

Disable mailbox audit logging bypass using PowerShell

A situation may arise where you need to disable mailbox audit bypass to ensure all actions performed by a specific account are logged for security and troubleshooting purposes. For instance, if a service account with audit bypass enabled shows unusual activity, removing it from bypass ensures its actions are recorded, aiding monitoring and investigation.

To remove a user from audit bypass, run the following cmdlet.

Set-MailboxAuditBypassAssociation –Identity "<user@contoso.com>" -AuditBypassEnabled $false

Replace <user@contoso.com> with the email address of the mailbox for which you want to configure audit bypass. This will remove the audit bypass association from the mailbox.

To confirm the audit bypass association configuration for a mailbox, run the following cmdlet.

Get-MailboxAuditBypassAssociation -Identity "<user@contoso.com>" | Format-List AuditByPassEnabled 

When audit logging is bypassed for a user, all mailbox actions performed by that user will no longer be captured in the audit logs. This reduction in audit data can impact visibility into mailbox activities, depending on how and to whom the bypass is applied. So, let's take a closer look at what happens when audit logging is bypassed in detail.

When audit bypass is enabled for a user, their mailbox activities are excluded from audit logging. This means that:

However, actions performed by other users or admins on the bypassed user's mailbox will still be recorded in the audit logs.

Note: Organizations with strict compliance requirements should use audit bypass cautiously. Applying it to high-risk accounts such as executives or privileged users can create regulatory gaps and weaken security oversight.

Instead of completely enabling or disabling mailbox audit logging for a mailbox, you can configure mailbox auditing it to capture only the actions that matter to your organization. Focusing on specific action types or specific logon types helps reduce audit clutter and makes your logs more relevant.

Below are various ways to configure mailbox auditing using PowerShell.

1. Configure mailbox audit logging for a specific logon type in Microsoft 365

You can specify actions to audit for each logon type such as Owner, Admin, or Delegate. For example, if you want to audit specific actions performed by delegate users on a mailbox, you can do so using the below cmdlet.

Ensure you connect to the Exchange Online PowerShell module before proceeding.

Set-Mailbox –Identity "<user@contoso.com>" –AuditDelegate SendAs,SendOnBehalf –AuditEnabled $true

This command ensures that SendAs and SendOnBehalf actions performed by delegate users on the mailbox of user@contoso.com are only logged. Replace <user@contoso.com> with the email address of the mailbox you want to configure.

2. Enable audit logging for targeted mailbox actions for all logon types

You can specify which actions to log such as Copy, FolderBind, HardDelete, SoftDelete, etc. Before executing, ensure to connect to Exchange Online PowerShell module.

Set-Mailbox –Identity "<user@contoso.com>" –AuditDelegate HardDelete,SoftDelete –AuditAdmin HardDelete,SoftDelete –AuditOwner HardDelete,SoftDelete –AuditEnabled $true

This command enables the Exchange Online to only log the HardDelete and SoftDelete actions performed by the owner, admin, and delegate on the particular mailbox. By specifying these actions under each logon type parameter, you ensure that those actions are captured in audit logs.

3. Append new actions without overwriting existing lists in Exchange Online

If you try to add actions to the existing audit settings by running the Set-Mailbox cmdlet as specified above, it will overwrite the previous configuration instead of appending to it.

To properly add new actions without losing existing ones, execute the below PowerShell cmdlet including the new actions.

Set-Mailbox –Identity "<admin@contoso.com>" –AuditDelegate @{Add=SendAs,SendOnBehalf}

Similarly, to remove specific actions from the existing audit settings without wiping the full configuration, use the below PowerShell cmdlet.

Set-Mailbox –Identity "<admin@contoso.com>" –AuditDelegate @{Remove=SendAs,SendOnBehalf}

Mailbox auditing plays a crucial role in identifying unauthorized access and safeguarding sensitive information in Exchange Online. While Microsoft has enabled auditing by default, not every mailbox action across admin, owner, and delegate logon types is audited. This inconsistency makes it difficult to determine which actions are being tracked and which are slipping through the cracks.

Since there is no built-in portal view or single PowerShell cmdlet to retrieve all non-audited mailbox actions in Exchange Online, identifying audit gaps can be challenging. To eliminate this lack of clarity, we have developed a PowerShell script that highlights mailbox actions not currently being audited.

Download and run the following script in the Administrator PowerShell.

The report provides key details such as: