How to check mailbox auditing in Exchange Online

Before you start

Use an account in the View-Only Organization Management role group, or with Global Reader, to read the mailboxes and the organisation setting. The bypass list comes from an audit cmdlet, which needs the Audit Logs or View-Only Audit Logs role; the Compliance Management and Organization Management role groups hold both. Purview portal searches need 1 of them there too.

The settings are read as they are now; audit records usually take 60 to 90 minutes to become searchable. Get-EXOMailbox leaves out Microsoft 365 Group mailboxes, which are audited with a fixed set of actions while the organisation setting is on. The examples read and export; they change nothing.

Option 1

Check mailbox auditing with PowerShell

Install the module once, then read the organisation setting and export each mailbox's audit properties.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline -ShowBanner:$false
try {
    $onByDefault = -not (Get-OrganizationConfig).AuditDisabled
    Write-Output "Mailbox auditing on by default: $onByDefault"
    $coveredTypes = 'UserMailbox', 'SharedMailbox'
    $mailboxes = @(Get-EXOMailbox -ResultSize Unlimited -PropertySets Minimum, Audit)
    $report = @(foreach ($mailbox in $mailboxes) {
        $type = $mailbox.RecipientTypeDetails
        [pscustomobject]@{
            DisplayName        = $mailbox.DisplayName
            PrimarySmtpAddress = $mailbox.PrimarySmtpAddress
            Type               = $type
            OnByDefault        = $onByDefault -and $coveredTypes -contains $type
            AuditEnabled       = $mailbox.AuditEnabled
            DefaultAuditSet    = $mailbox.DefaultAuditSet -join ', '
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'No mailboxes were returned.'
    } else {
        $report | Sort-Object OnByDefault, DisplayName |
            Export-Csv -Path './mailbox-auditing.csv' -NoTypeInformation -Encoding utf8
        $outside = @($report | Where-Object { -not $_.OnByDefault }).Count
        Write-Output "$($report.Count) mailboxes exported; $outside not covered by default."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

If the first line says False, no mailbox is audited. OnByDefault is True for user and shared mailboxes while the setting is on; AuditEnabled shows True on them either way, so it says little alone. Room and equipment mailboxes come out False, as auditing does not cover them. A DefaultAuditSet other than Admin, Delegate, Owner means the audited actions were changed for the sign-in types missing, and Microsoft no longer adds new actions to those.

Find accounts that bypass auditing

Reconnect with Connect-ExchangeOnline, as the export above disconnects, then list the accounts set to bypass auditing.

# Run while connected to Exchange Online.
Get-MailboxAuditBypassAssociation -ResultSize Unlimited |
    Where-Object { $_.AuditBypassEnabled } |
    Select-Object Name, AuditBypassEnabled

Nothing these accounts do in any mailbox is logged. No output means none bypasses auditing. If the command is refused, Get-ManagementRole -Cmdlet Get-MailboxAuditBypassAssociation lists the roles that can run it.

Option 2

Check the audit log in the Microsoft Purview portal

1. Sign in to the Microsoft Purview portal for the correct tenant.
2. Select the Audit solution card, or View all solutions > Audit if it is not shown.
3. A banner offering to Start recording user and admin activity means the audit log is off and searches return nothing. Selecting it turns auditing on.
4. To see 1 mailbox's records, on the Search page set Date and time range (UTC), choose the person in Users (for a shared mailbox, enter its address in Keyword Search) and select Search.
5. Open the finished search job to read the activities. It is kept for 30 days; to remove it, select it and select Delete.

This suits confirming that records reach the log for 1 mailbox. For the organisation setting, audited actions and the bypass list, use PowerShell or a report.

Common questions

Can I turn auditing off for 1 mailbox?

No. While auditing is on by default, Exchange Online ignores AuditEnabled set to False. Only bypass keeps a person's actions out of the log, so review the bypass list.

Should I raise AuditLogAgeLimit to keep records longer?

No. Audit log retention policies in Microsoft Purview decide how long mailbox audit records are kept: 180 days by default, or 1 year for Exchange activity of users with an E5 licence.

Why does a search find nothing when mailbox auditing is on?

Check the audit log itself. Run Get-AdminAuditLogConfig in Exchange Online PowerShell and read UnifiedAuditLogIngestionEnabled: Business Basic, Business Standard and Business Premium tenants do not have it on by default. To see who can open a mailbox at all, see how to export mailbox permissions.