(L1) Ensure mailbox audit actions are configured

Contributed by jeremy finneyAll contributors →

Part of CIS · Exchange Online · Mailbox auditing · All checks

Run this check

Invoke-Maester -TestId CIS.M365.6.1.2

Overview

Every user mailbox audits the recommended set of actions for administrators, delegates and mailbox owners.

Exchange Online audits a default set of actions. Some actions that matter in an investigation, such as MailItemsAccessed, which shows which messages an attacker read, and the actions that change inbox rules and folder permissions, are not part of every default set, or an administrator may have reduced the list.

The test looks at all user mailboxes and lists those that have auditing disabled or miss one of the recommended actions. A listed mailbox needs the recommended actions added to its own audit settings. If the tenant has no user mailboxes, the check is not applicable and is skipped. Microsoft Purview Audit (Standard) is enough for the default set, and MailItemsAccessed needs a licence that includes Audit (Premium) for some users.

Remediation action

1. Connect to Exchange Online with Connect-ExchangeOnline.
2. Run the following script to add the CIS audit actions to every user mailbox while preserving any additional actions already configured. It also enables auditing and sets the audit log age limit to 180 days as shown in the CIS remediation procedure.

$AuditAdmin = @(
    'ApplyRecord', 'Copy', 'Create', 'FolderBind', 'HardDelete',
    'MailItemsAccessed', 'Move', 'MoveToDeletedItems', 'SendAs',
    'SendOnBehalf', 'Send', 'SoftDelete', 'Update',
    'UpdateCalendarDelegation', 'UpdateFolderPermissions', 'UpdateInboxRules'
)
$AuditDelegate = @(
    'ApplyRecord', 'Create', 'FolderBind', 'HardDelete', 'Move',
    'MailItemsAccessed', 'MoveToDeletedItems', 'SendAs', 'SendOnBehalf',
    'SoftDelete', 'Update', 'UpdateFolderPermissions', 'UpdateInboxRules'
)
$AuditOwner = @(
    'ApplyRecord', 'Create', 'HardDelete', 'MailboxLogin', 'Move',
    'MailItemsAccessed', 'MoveToDeletedItems', 'Send', 'SoftDelete',
    'Update', 'UpdateCalendarDelegation', 'UpdateFolderPermissions', 'UpdateInboxRules'
)
$Mailboxes = Get-EXOMailbox -RecipientTypeDetails UserMailbox -PropertySets Audit,Minimum -ResultSize Unlimited

foreach ($Mailbox in $Mailboxes) {
    Set-Mailbox -Identity $Mailbox.UserPrincipalName `
        -AuditEnabled $true `
        -AuditLogAgeLimit 180 `
        -AuditAdmin @{ Add = $AuditAdmin } `
        -AuditDelegate @{ Add = $AuditDelegate } `
        -AuditOwner @{ Add = $AuditOwner }
}

3. Check the result with Get-EXOMailbox -RecipientTypeDetails UserMailbox -PropertySets Audit,Minimum -ResultSize Unlimited and confirm AuditEnabled and the required actions are present.

Related links

• Manage mailbox auditing
• Set-Mailbox
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.2

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.6.1.2
Severity	Medium
Suite	CIS
Product	Exchange Online
Feature	Mailbox auditing
Area	Logging and detection
Resource type	Mailbox
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.1.2, nist-800-53-r5:AU-12
PowerShell test	Test-MtCisMailboxAuditAction
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.6.1.2.ps1
• Documentation: tests/cis/Test.CIS.M365.6.1.2.md