M365 Exchange Audit Logs are records of administrative and mailbox activity in Microsoft 365 Exchange, showing who did what and when. They capture actions such as mailbox rule changes, message access and permission changes, and are used for investigation, compliance and access monitoring.
What Exchange audit logs capture
Exchange audit logs are not just a record of user activity, they are a chronology of administrative and mailbox events that lets investigators reconstruct actions, timing and scope. For Microsoft 365 environments, that means the log stream becomes an accountability layer around mailbox configuration, message handling and permission changes.
Because the subject is activity visibility rather than content delivery, the key question is whether the right operations are being logged at the right fidelity. If mailbox actions, admin changes or access events are missing, the log can create a false sense of oversight while important evidence is absent.
Why Exchange audit logs matter
These logs matter because mailbox activity often sits at the centre of business email compromise, insider misuse and post-compromise investigation. A mailbox rule change, delegation change or message access event can be an early sign that an account has been abused, or the only durable evidence that abuse occurred.
They also support compliance and access monitoring by showing who changed what and when. That makes the log useful for review, recertification and investigation workflows, especially where mailbox permissions or message access are sensitive enough to require auditability.
For Microsoft 365 environments, the broader Microsoft 365 Unified Audit Log Guide for Detection is the natural companion when you need to understand how Exchange events fit into tenant-wide detection and retention.
What good coverage looks like
Useful Exchange auditing is about coverage, continuity and queryability. Organisations need to know which mailbox and administrative events are emitted, how long they remain searchable, and whether the log can be exported into a central detection platform without losing critical fields or time ordering.
A practical audit trail should support queries that distinguish normal administration from suspicious change, such as unexpected forwarding rules, delegate additions, permission grants and message access patterns. If the log cannot support that level of reconstruction, it is hard to use it for investigations or for proving control operation to auditors.
That is why log retention and integrity are as important as event capture. The Log Management and Retention Guide is useful when the main problem is preserving audit evidence long enough to meet operational and compliance needs.
How the logs are used in investigations
In practice, Exchange audit logs help answer three questions: what changed, who changed it and whether the change lines up with authorised administration. Investigators use them to trace suspicious mailbox rule creation, access to messages that should not have been opened, and permission changes that expand access to a mailbox or its contents.
They are also valuable after an incident, because mailbox and admin activity can reveal whether an attacker used legitimate access rather than obvious malware or obvious login anomalies. That makes the log a bridge between identity events, mailbox behaviour and the evidence needed to determine scope.
When the issue extends beyond Exchange into broader Microsoft 365 investigation work, Collaboration platform investigations provides adjacent evidence handling context for related messaging and workspace scenarios.
Common failure modes and governance gaps
Audit logs fail most often when coverage is assumed rather than verified. Gaps in retention, disabled collection paths, incomplete event visibility or weak review practices can leave organisations unable to reconstruct mailbox abuse after the fact. In other cases, the logs exist but are not routed to monitoring where suspicious patterns can be correlated with other signals.
Governance gaps also appear when teams treat mailbox auditing as a technical setting instead of an evidence source with ownership, retention and review requirements. Without clear responsibility for review and preservation, the logs may remain available in name only, while the organisation loses the ability to use them operationally.
For the control angle, CIS Controls v8 is a useful external reference for the broader logging, access control and account management practices that make audit trails actionable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-8 — Audit Log Management | Exchange audit logs are a logging and monitoring control with investigation value. |
| Recommendation — Collect and review Exchange audit events centrally to support detection and incident investigation. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | Defines which Exchange actions should be audited for accountability and investigation. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Exchange audit logs are only useful when reviewed and analysed for suspicious mailbox activity. | |
| AU-11 — Audit Record Retention | Retention determines whether Exchange audit evidence remains available for investigations and compliance. | |
| Recommendation — Define required mailbox and administrative audit events for Exchange activity. Review Exchange audit records for suspicious mailbox rules, permission changes and access anomalies. Set audit retention long enough to preserve Exchange evidence for investigations and audit. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org