Back to Checks
m365

Mailbox has AuditBypassEnabled disabled

exchange_mailbox_audit_bypass_disabled
Service: exchangeSeverity: high
OfficialBuilt-inVerified
Categories:loggingforensics-readye3
Resource Type:NotDefined

Microsoft 365 Exchange Online mailboxes are evaluated for audit logging bypass by reviewing the AuditBypassEnabled setting and identifying mailboxes where auditing can be circumvented.

Prowler logoProwlerprowler-provider-m365

Risk

Bypassed mailbox auditing removes visibility into access and actions, weakening detective controls. Covert data exfiltration, inbox-rule abuse, and persistence become harder to spot, harming confidentiality and integrity and impeding forensics.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_mailbox_audit_bypass_disabled

Recommendation

Disable audit bypass by keeping AuditBypassEnabled set to false for all accounts. Apply least privilege to service identities, use dedicated accounts for automation, and monitor for bypass associations with alerts. Enforce separation of duties and preserve tamper-resistant audit logs.

Remediation

CLI

Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where-Object {$_.AuditBypassEnabled} | ForEach-Object { Set-MailboxAuditBypassAssociation -Identity $_.Identity -AuditBypassEnabled $false }

Other

1Open PowerShell and connect to Exchange Online: Connect-ExchangeOnline
2Run:
3```
4Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where-Object {$_.AuditBypassEnabled} | ForEach-Object { Set-MailboxAuditBypassAssociation -Identity $_.Identity -AuditBypassEnabled $false }
5```

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_mailbox_audit_bypass_disabled(Check):
    """Verify if Exchange mailbox auditing is enabled.

    This check ensures that mailbox auditing is not bypassed and is properly enabled.
    """

    def execute(self) -> List[CheckReportM365]:
        """Run the check to validate Exchange mailbox auditing.

        Iterates through the mailbox configurations to determine if auditing is enabled
        and generates a report for each mailbox.

        Returns:
            List[CheckReportM365]: A list of reports with the audit status for each mailbox.
        """
        findings = []
        for mailbox_config in exchange_client.mailboxes_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=mailbox_config,
                resource_name=mailbox_config.name,
                resource_id=mailbox_config.id,
            )
            report.status = "FAIL"
            report.status_extended = f"Exchange mailbox auditing is bypassed and not enabled for mailbox: {mailbox_config.name}."

            if not mailbox_config.audit_bypass_enabled:
                report.status = "PASS"
                report.status_extended = f"Exchange mailbox auditing is enabled for mailbox: {mailbox_config.name}."

            findings.append(report)

        return findings

References