Feedback by UserVoice

How can we improve compliance or protect your users better in Office 365?

Make sure that Exchange Online mailboxes are enabled for auditing

The big problem with mailbox auditing – for both Exchange on-premises and Exchange Online – is that you must enable it for mailboxes to start recording audit events. If you do not enable auditing for a mailbox, Exchange assumes that you don’t care about what’s going on and captures nothing. When the time comes to search the Office 365 audit log, you get a big fat blank. Microsoft should either enable all EXO mailboxes for auditing or allow tenants to update mailbox plans to ensure that new mailboxes are enabled upon creation.

338 votes
Vote
Sign in
Check!
(thinking…)
Reset
or sign in with
  • facebook
  • google
    Password icon
    Signed in as (Sign out)
    You have left! (?) (thinking…)
    Anonymous shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

    14 comments

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Signed in as (Sign out)
      Submitting...
      • Brian T. Grant commented  ·   ·  Flag as inappropriate

        even if it gets enabled by default that is only one step as I understand that is only basic auditing.
        Owner, Admin & delegate with extended parameters should be applied by you.

      • Hasan commented  ·   ·  Flag as inappropriate

        By deafult it should be enabled when mailbox created in Office365 or migrated from Onprem to Office365

      • Anonymous commented  ·   ·  Flag as inappropriate

        I agree, that will be great to have the option to enable auditing when creating user account. that will be very useful.

      • kaveh commented  ·   ·  Flag as inappropriate

        noticed Set-MailboxPlan has an '-AuditEnabled' switch already, just that its currently reserved for internal use... c'mon guys!

      • kaveh commented  ·   ·  Flag as inappropriate

        Yes the issue is we dont use powershell to create users, and need this enabled for new mailboxes that are created.

      • Matt commented  ·   ·  Flag as inappropriate

        How is this not done yet? Having the option to enable/disable auditing by default on the tenant has been being asked for for years now. Cmon MS...

      • Ryan Pizzi commented  ·   ·  Flag as inappropriate

        Very much agreed on this. I'm told that ASM (Now CAS) required mailbox auditing to become useful at all. If this is a requirement, I'm sure we'd all appreciate a method to have mailboxes start out with auditing enabled (and perhaps what to audit).

      • Richard commented  ·   ·  Flag as inappropriate

        There are numerous tickets with varying amounts of votes that are all asking for the same thing:

        Give us the ability to enable mailbox auditing by default for every account in AAD.

        Even better, let us specify mailbox auditing policies hierarchically, as in GPOs. We should be using AAD as the source of truth on user objects, including mailboxes. I don't get why this is a per-user Powershell-only option right now. Seriously it confounds us.

      • James Reed commented  ·   ·  Flag as inappropriate

        This needs to be done on all mailboxes, inclusive of the underlying O365 Group mailboxes.
        This should be the default setting for all, so there would be no reason it randomly disables or certain elements get removed from auditing.

      • Anonymous commented  ·   ·  Flag as inappropriate

        By deafult it should be enabled when mailbox created in Office365 or migrated from Onprem to Office365

      Feedback and Knowledge Base