Mailbox Audit Log
Mailbox Audit Logging tracks actions taken by users and administrators on mailboxes, providing visibility into mailbox activity for security and compliance purposes. Enabling this feature helps detect unauthorized access and supports forensic investigations.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Mailbox auditing disabled | Controls whether mailbox auditing is disabled for the organization. Learn more |
Configure it
This baseline keeps mailbox auditing on across the tenant in Exchange Online, so mailbox actions are logged for every mailbox.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Leave Mailbox auditing disabled switched off. That’s Microsoft’s default for most tenants, and it means mailbox actions (sign-ins, message reads, sends, deletions and more) are logged for every mailbox, whatever that mailbox’s own auditing setting.
-
Auditing isn’t switched on by default for the smaller Business Basic, Business Standard and Business Premium licences, or for an unmanaged enterprise trial. Those tenants need this baseline to turn it on, not only confirm it.
-
Save. Turn on Auto-remediation and Octiga switches mailbox auditing back on automatically if it’s turned off tenant-wide. Users notice nothing either way: this only affects what gets logged, not what they can do.
Check it worked
Passing means Exchange Online’s organisation configuration reports mailbox auditing as not disabled. The audit records themselves are searched on the Microsoft Purview portal’s Audit page rather than seen as a setting, and they’re only searchable there when Unified Audit Log is also switched on. Nothing changes visibly in a user’s mailbox; their activity starts being recorded.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.