CIS.M365.6.1.3 - (L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes
Overview
No account is configured to bypass mailbox audit logging.
Audit bypass is meant for service accounts that generate a lot of noise, such as a monitoring or journaling account. Anything such an account does in any mailbox is not logged. An attacker or a malicious administrator with an account on the bypass list can read and change mail with no record in the audit log.
Remove the bypass from every account and reduce the noise in another way, for example by filtering the audit log when you search it.
Note: This test is
LongRunning. It reads the audit bypass setting of every mailbox and recipient, which can take a long time in large tenants. UseInvoke-Maester -IncludeLongRunningto run it, or select it by ID.
Remediation action
- Connect to Exchange Online with
Connect-ExchangeOnline. - List the accounts with
Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled }. - For each account run
Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $false.
Related links
- Manage mailbox auditing
- Set-MailboxAuditBypassAssociation
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.3
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.1.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mailbox auditing |
| Area | Logging and detection |
| Resource type | Mailbox |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.1.3, nist-800-53-r5:AU-12 |
| PowerShell test | Test-MtCisMailboxAuditBypass |
| Services | ExchangeOnline |
| Long running | Yes |
Source
- Test:
tests/cis/Test.CIS.M365.6.1.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.1.3.md