# Mailbox Audit Log

> Mailbox Audit Logging tracks actions taken by users and administrators on mailboxes, providing visibility into mailbox activity for security and compliance pur…

Mailbox Audit Logging tracks actions taken by users and administrators on mailboxes, providing visibility into mailbox activity for security and compliance purposes. Enabling this feature helps detect unauthorized access and supports forensic investigations.

## Settings this baseline controls

| Setting                   | What it does                                                                                                                                                                           |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Mailbox auditing disabled | Controls whether mailbox auditing is disabled for the organization. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-organizationconfig?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline keeps mailbox auditing on across the tenant in Exchange Online, so mailbox actions
are logged for every mailbox.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Mailbox auditing disabled** switched off. That's Microsoft's default for most
   tenants, and it means mailbox actions (sign-ins, message reads, sends, deletions and more)
   are logged for every mailbox, whatever that mailbox's own auditing setting.
3. Auditing isn't switched on by default for the smaller Business Basic, Business Standard and
   Business Premium licences, or for an unmanaged enterprise trial. Those tenants need this
   baseline to turn it on, not only confirm it.
4. Save. Turn on **Auto-remediation** and Octiga switches mailbox auditing back on automatically if
   it's turned off tenant-wide. Users notice nothing either way: this only affects what gets
   logged, not what they can do.

## Check it worked

**Passing** means Exchange Online's organisation configuration reports mailbox auditing as not
disabled. The audit records themselves are searched on the Microsoft Purview portal's **Audit**
page rather than seen as a setting, and they're only searchable there when
[Unified Audit Log](https://docs.octiga.io/baselines/audit/org-unified-audit-log/) is also switched on. Nothing changes visibly in a
user's mailbox; their activity starts being recorded.

## Standards this addresses

### CIS

- **M365 6.1.2** — CIS M365 Foundations Benchmark 6.1.2
- **M365 6.1.3** — CIS M365 Foundations Benchmark 6.1.3
- **v8 8.2** — CIS Controls v8 Safeguard 8.2

### NIST

- **PR.IP-1** — NIST CSF 2.0 PR.IP-1
- **AU-2** — NIST SP 800-53 AU-2
- **AU-12** — NIST SP 800-53 AU-12

### ISO 27001

- **A.8.16** — ISO/IEC 27001:2022 Annex A.8.16

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)