# (L1) Ensure 'AuditDisabled' organizationally is set to 'False'

(L1) Ensure 'AuditDisabled' organizationally is set to 'False'. A Maester check for Exchange Online, Mailbox auditing.

Source: https://maester.dev/docs/tests/CIS.M365.6.1.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Mailbox auditing · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.1.1
```

## Overview

Mailbox auditing is switched on organisation-wide in Exchange Online.

Mailbox audit logs record who accessed a mailbox and what they did: logons, reads, moves, deletions and rule changes. They are the evidence that is needed to investigate a business email compromise. With auditing off for the organisation, mailbox owners, delegates and administrators leave no trace.

Mailbox auditing is on by default. Someone has to turn it off deliberately, so a failure here deserves investigation as well as a fix.

#### Remediation action

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Set-OrganizationConfig -AuditDisabled $false`.
3. Check the result with `Get-OrganizationConfig | Format-List AuditDisabled`.

#### Related links

* [Manage mailbox auditing](https://learn.microsoft.com/purview/audit-mailboxes)
* [Set-OrganizationConfig](https://learn.microsoft.com/powershell/module/exchange/set-organizationconfig)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.1](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.1.1 |
| Severity | High |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mailbox auditing |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.1.1, nist-800-53-r5:AU-12 |
| PowerShell test | [Test-MtCisOrganizationAuditEnabled](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.1.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.1.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.1.md)