Mailbox auditing SHALL be enabled

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Exchange Online · Mailbox auditing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.13.1

Overview

Mailbox auditing SHALL be enabled.

Rationale: Exchange Online user accounts can be compromised or misused. Enabling mailbox auditing provides a valuable source of information to detect and respond to mailbox misuse.

Remediation action

Mailbox auditing can be managed from the Exchange Online PowerShell module. Follow the instructions listed on Manage mailbox auditing in Office 365.

1. To enable mailbox auditing by default for your organization via PowerShell:
2. Connect to the Exchange Online PowerShell.
3. Run the following command: Set-OrganizationConfig –AuditDisabled $false

Related links

• Microsoft Learn - Mailbox Auditing
• CISA 13 Mailbox Auditing - MS.EXO.13.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.13.1
Severity	High
Suite	CISA
Product	Exchange Online
Feature	Mailbox auditing
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1070.008 Clear Mailbox Data, T1098.002 Additional Email Delegate Permissions, T1564.008 Email Hiding Rules, T1586.002 Email Accounts, T1685.002 Disable or Modify Cloud Log
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.13.1
Criticality	SHALL
Upstream requirement	MS.EXO.13.1v1
Supports controls	cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12c
PowerShell test	Test-MtCisaMailboxAuditing
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.13.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.13.1.md