Make sure that Exchange Online mailboxes are enabled for auditing
The big problem with mailbox auditing – for both Exchange on-premises and Exchange Online – is that you must enable it for mailboxes to start recording audit events. If you do not enable auditing for a mailbox, Exchange assumes that you don’t care about what’s going on and captures nothing. When the time comes to search the Office 365 audit log, you get a big fat blank. Microsoft should either enable all EXO mailboxes for auditing or allow tenants to update mailbox plans to ensure that new mailboxes are enabled upon creation.
Anonymous
shared this idea
21 comments
-
FinTom
commented
I think this is enabled by default now
-
Andy Swiffin
commented
Over 3 years and still no action on this. If you look at a user with powershell it tells you it's '$true' but there are no logs in the portal but there are in powershell. If you set it to $false it says "the command ran but no changes were made" - hmmm something very broken here. Then when you set it $true it finally works. We shouldn't have to do this!!
-
Drew
commented
Exchange Online email auditing is a total joke. Now Microsoft is requiring an E5 license to search logging in the SCC. If you turned it on for your E3 users they are now grandfathered in. However, if you didn't they will need an E5 licensing. This is nothing short of extortion from Microsoft, forcing companies to E5. Terribly unethical!
-
Rick P
commented
If not on by default (which is the obvious answer) having an ability to flip one switch instead of Get-Mailbox -Filter {AuditEnabled -eq $False} -RecipientTypeDetails UserMailbox, SharedMailbox | Set-Mailbox -AuditEnabled $True –AuditDelegate Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems (and then manually enabling for each created mailbox thereafter).
Get Bill Gates in here!
-
Anonymous
commented
This is RIDICULOUS. Has just left us with no angle to trace a compromise.
-
Anonymous
commented
Should be enable by Default
-
Peter Hurst
commented
On large tenancies it's particularly difficult to backfit with the recommended solution as the number of mailboxes exceed the maximum allowed.
-
Brian T. Grant
commented
even if it gets enabled by default that is only one step as I understand that is only basic auditing.
Owner, Admin & delegate with extended parameters should be applied by you. -
Brajesh Panda
commented
-
Michael Gorn
commented
this should be enabled by default ASAP!
-
Hasan
commented
By deafult it should be enabled when mailbox created in Office365 or migrated from Onprem to Office365
-
Anonymous
commented
I agree, that will be great to have the option to enable auditing when creating user account. that will be very useful.
-
kaveh
commented
noticed Set-MailboxPlan has an '-AuditEnabled' switch already, just that its currently reserved for internal use... c'mon guys!
-
kaveh
commented
need a tenant wide, or mailbox plan wide setting
-
kaveh
commented
Yes the issue is we dont use powershell to create users, and need this enabled for new mailboxes that are created.
-
Matt
commented
How is this not done yet? Having the option to enable/disable auditing by default on the tenant has been being asked for for years now. Cmon MS...
-
Ryan
commented
Should be enabled by default.
-
Ryan Pizzi
commented
Very much agreed on this. I'm told that ASM (Now CAS) required mailbox auditing to become useful at all. If this is a requirement, I'm sure we'd all appreciate a method to have mailboxes start out with auditing enabled (and perhaps what to audit).
-
Richard
commented
There are numerous tickets with varying amounts of votes that are all asking for the same thing:
Give us the ability to enable mailbox auditing by default for every account in AAD.
Even better, let us specify mailbox auditing policies hierarchically, as in GPOs. We should be using AAD as the source of truth on user objects, including mailboxes. I don't get why this is a per-user Powershell-only option right now. Seriously it confounds us.
-
James Reed
commented
This needs to be done on all mailboxes, inclusive of the underlying O365 Group mailboxes.
This should be the default setting for all, so there would be no reason it randomly disables or certain elements get removed from auditing.