CIS.M365.6.1.1 - (L1) Ensure 'AuditDisabled' organizationally is set to 'False'
Overview
Mailbox auditing is switched on organisation-wide in Exchange Online.
Mailbox audit logs record who accessed a mailbox and what they did: logons, reads, moves, deletions and rule changes. They are the evidence that is needed to investigate a business email compromise. With auditing off for the organisation, mailbox owners, delegates and administrators leave no trace.
Mailbox auditing is on by default. Someone has to turn it off deliberately, so a failure here deserves investigation as well as a fix.
Remediation action
- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OrganizationConfig -AuditDisabled $false. - Check the result with
Get-OrganizationConfig | Format-List AuditDisabled.
Related links
- Manage mailbox auditing
- Set-OrganizationConfig
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.1
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.1.1 |
| Severity | High |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mailbox auditing |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.1.1, nist-800-53-r5:AU-12 |
| PowerShell test | Test-MtCisOrganizationAuditEnabled |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.1.1.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.1.1.md