(L1) Ensure 'AuditDisabled' organizationally is set to 'False'

Contributed by jeremy finneyAll contributors →

Part of CIS · Exchange Online · Mailbox auditing · All checks

Run this check

Invoke-Maester -TestId CIS.M365.6.1.1

Overview

Mailbox auditing is switched on organisation-wide in Exchange Online.

Mailbox audit logs record who accessed a mailbox and what they did: logons, reads, moves, deletions and rule changes. They are the evidence that is needed to investigate a business email compromise. With auditing off for the organisation, mailbox owners, delegates and administrators leave no trace.

Mailbox auditing is on by default. Someone has to turn it off deliberately, so a failure here deserves investigation as well as a fix.

Remediation action

1. Connect to Exchange Online with Connect-ExchangeOnline.
2. Run Set-OrganizationConfig -AuditDisabled $false.
3. Check the result with Get-OrganizationConfig | Format-List AuditDisabled.

Related links

• Manage mailbox auditing
• Set-OrganizationConfig
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.1

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.6.1.1
Severity	High
Suite	CIS
Product	Exchange Online
Feature	Mailbox auditing
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.1
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.1.1, nist-800-53-r5:AU-12
PowerShell test	Test-MtCisOrganizationAuditEnabled
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.6.1.1.ps1
• Documentation: tests/cis/Test.CIS.M365.6.1.1.md