Make sure that Exchange Online mailboxes are enabled for auditing
The big problem with mailbox auditing – for both Exchange on-premises and Exchange Online – is that you must enable it for mailboxes to start recording audit events. If you do not enable auditing for a mailbox, Exchange assumes that you don’t care about what’s going on and captures nothing. When the time comes to search the Office 365 audit log, you get a big fat blank. Microsoft should either enable all EXO mailboxes for auditing or allow tenants to update mailbox plans to ensure that new mailboxes are enabled upon creation.
Anonymous
shared this idea
18 comments
-
Rick P
commented
If not on by default (which is the obvious answer) having an ability to flip one switch instead of Get-Mailbox -Filter {AuditEnabled -eq $False} -RecipientTypeDetails UserMailbox, SharedMailbox | Set-Mailbox -AuditEnabled $True –AuditDelegate Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems (and then manually enabling for each created mailbox thereafter).
Get Bill Gates in here!
-
Anonymous
commented
This is RIDICULOUS. Has just left us with no angle to trace a compromise.
-
Anonymous
commented
Should be enable by Default
-
Peter Hurst
commented
On large tenancies it's particularly difficult to backfit with the recommended solution as the number of mailboxes exceed the maximum allowed.
-
Brian T. Grant
commented
even if it gets enabled by default that is only one step as I understand that is only basic auditing.
Owner, Admin & delegate with extended parameters should be applied by you. -
Brajesh Panda
commented
-
Michael Gorn
commented
this should be enabled by default ASAP!
-
Hasan
commented
By deafult it should be enabled when mailbox created in Office365 or migrated from Onprem to Office365
-
Anonymous
commented
I agree, that will be great to have the option to enable auditing when creating user account. that will be very useful.
-
kaveh
commented
noticed Set-MailboxPlan has an '-AuditEnabled' switch already, just that its currently reserved for internal use... c'mon guys!
-
kaveh
commented
need a tenant wide, or mailbox plan wide setting
-
kaveh
commented
Yes the issue is we dont use powershell to create users, and need this enabled for new mailboxes that are created.
-
Matt
commented
How is this not done yet? Having the option to enable/disable auditing by default on the tenant has been being asked for for years now. Cmon MS...
-
Ryan
commented
Should be enabled by default.
-
Ryan Pizzi
commented
Very much agreed on this. I'm told that ASM (Now CAS) required mailbox auditing to become useful at all. If this is a requirement, I'm sure we'd all appreciate a method to have mailboxes start out with auditing enabled (and perhaps what to audit).
-
Richard
commented
There are numerous tickets with varying amounts of votes that are all asking for the same thing:
Give us the ability to enable mailbox auditing by default for every account in AAD.
Even better, let us specify mailbox auditing policies hierarchically, as in GPOs. We should be using AAD as the source of truth on user objects, including mailboxes. I don't get why this is a per-user Powershell-only option right now. Seriously it confounds us.
-
James Reed
commented
This needs to be done on all mailboxes, inclusive of the underlying O365 Group mailboxes.
This should be the default setting for all, so there would be no reason it randomly disables or certain elements get removed from auditing. -
Anonymous
commented
By deafult it should be enabled when mailbox created in Office365 or migrated from Onprem to Office365