Back to Checks
m365

Organization has mailbox auditing enabled

exchange_organization_mailbox_auditing_enabled
Service: exchangeSeverity: high
OfficialBuilt-inVerified
Categories:logginge3
Resource Type:NotDefined

Microsoft 365 Exchange Online organization setting AuditDisabled controls tenant-wide mailbox auditing. This evaluates whether it is False so default audit events are recorded for owner, delegate, and admin across all mailboxes, taking precedence over per-mailbox settings.

Prowler logoProwlerprowler-provider-m365

Risk

Disabling tenant-wide auditing lets mailbox activity go unrecorded. Adversaries or insiders could exfiltrate data, alter or delete messages, or send as users without trace, undermining confidentiality, integrity, and effective incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_organization_mailbox_auditing_enabled

Recommendation

Ensure AuditDisabled=False to keep mailbox auditing on by default.

  • Apply least privilege and minimize audit bypass
  • Define retention and review audit logs
  • Alert on risky actions (e.g., hard delete, rule changes)
  • Layer with defense in depth for email access

Remediation

CLI

Set-OrganizationConfig -AuditDisabled $false

Other

1Open PowerShell and connect to Exchange Online: Connect-ExchangeOnline
2Run: Set-OrganizationConfig -AuditDisabled $false
3Verify: Get-OrganizationConfig | Select-Object AuditDisabled (should be False)

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_organization_mailbox_auditing_enabled(Check):
    """Check if Exchange mailbox auditing is enabled.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for Exchange mailbox auditing.

        This method checks if mailbox auditing is enabled in the Exchange organization configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        organization_config = exchange_client.organization_config
        if organization_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=organization_config,
                resource_name=organization_config.name,
                resource_id=organization_config.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "Exchange mailbox auditing is not enabled on your organization."
            )

            if not organization_config.audit_disabled:
                report.status = "PASS"
                report.status_extended = (
                    "Exchange mailbox auditing is enabled on your organization."
                )

            findings.append(report)

        return findings

References