How do you enable mailbox auditing in Exchange Online?

What mailbox auditing actually covers in Exchange Online

Mailbox auditing records mailbox actions such as access, send-as, send-on-behalf-of, move, delete, and folder-level activity, so the first task is to confirm that the mailbox is being audited at the scope you expect. The practical question is not just whether auditing exists, but whether the right actions are captured and retained long enough to support investigation.

In Exchange Online, mailbox auditing is usually on by default for most mailbox types, but that does not remove the need to validate mailbox-level settings and your overall logging path. If you rely on audit trails for incident response, compliance, or internal monitoring, you need to verify both the mailbox configuration and the downstream place where audit events are reviewed.

Microsoft 365 operators often treat mailbox auditing as part of a broader Microsoft 365 Security Guide approach, because mailbox audit data is only useful when it is tied into tenant-wide logging, alerting, and investigation workflows.

How to verify it is enabled and useful

The safest approach is to confirm auditing at the mailbox level for the mailboxes that matter most, especially executives, service desks, shared mailboxes, and high-risk users. You should also confirm that the audit actions you care about are present, because a mailbox can be technically enabled for auditing while still missing the event types that matter to your investigation model.

Review whether the audit trail is actually landing in the place your team monitors, and whether retention settings are long enough to catch delayed discovery. If the events are available only in a low-friction admin workflow and not in your monitoring stack, the control exists but its operational value is limited.

Mailbox access review is also about governance, not just configuration. The audit trail should support decisions about who can read mailbox contents, impersonate a sender, or remove evidence from a mailbox, which is why many teams pair it with the Ultimate Guide to NHIs, Regulatory and Audit Perspectives when they are documenting access accountability and audit evidence.

What usually breaks mailbox auditing value in practice

The most common failure is not that mailbox auditing is absent, but that organisations assume a default setting is enough. If administrators, delegates, or applications can act on a mailbox and the resulting activity is not reviewed, then the mailbox can be quietly abused without creating a meaningful response path.

Another weak point is overconfidence in logs without checking the investigation workflow. A mailbox audit trail that is not centralised, searchable, and retained long enough for incident handling will not help much when you need to reconstruct who accessed a mailbox or when a suspicious send-as action occurred.

Mailbox auditing also becomes much more important when mail access is part of a broader token or key compromise story. If an attacker or insider has already obtained privileged access to email, the audit trail may be one of the few ways to reconstruct whether mailbox content was reviewed, exported, or used to stage follow-on abuse. The Microsoft Storm-0558 key breach 2023 is a reminder that mail access incidents can persist beyond the initial compromise if identity material is not controlled carefully.

Risk and Threat Considerations

Mailbox auditing reduces blind spots, but it does not stop misuse on its own. If delegated access, send-as rights, or mailbox deletion activity is not actively monitored, an attacker or malicious insider can use legitimate mailbox permissions to read, alter, or destroy evidence while blending in with normal administration.

Failure mechanism: The mailbox is technically auditable, but the audit trail is incomplete, not retained long enough, or not reviewed in the same place as other security telemetry, so suspicious access is missed until after the impact window has closed.

Impact: Investigators lose visibility into mailbox abuse, incident timelines become harder to prove, and email-based persistence, impersonation, or evidence destruction can continue without timely detection.

Practitioner Guidance

What to verify: Confirm mailbox auditing on the mailboxes that matter most, then test that the exact actions you expect, especially access, send-as, send-on-behalf-of, and delete activity, are actually being captured and retained.

What to prioritise: Put high-value and high-risk mailboxes first, then move to shared and delegated mailboxes, because those are the places where abuse or impersonation tends to have the widest blast radius.

Decision rule: If the mailbox is used for privileged, shared, or business-critical communication, treat missing or short-retention audit coverage as an operational gap that needs correction before you rely on the mailbox for incident evidence.

Practitioner takeaway: Mailbox auditing is only useful when it is verified, retained, and reviewed as part of a real investigation path, not assumed to be enough because the tenant default is enabled.

Related resources from NHI Mgmt Group

• How can organisations control mailbox forwarding risk in Exchange Online?
• Why do delegated mailbox permissions create security risk in Exchange Online?
• How do you scope application access to Exchange Online mailboxes?
• How do you detect Exchange mailbox exports to file shares?