(L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes

Contributed by jeremy finneyAll contributors →

Part of CIS · Exchange Online · Mailbox auditing · All checks

Run this check

Invoke-Maester -TestId CIS.M365.6.1.3

Overview

No account is configured to bypass mailbox audit logging.

Audit bypass is meant for service accounts that generate a lot of noise, such as a monitoring or journaling account. Anything such an account does in any mailbox is not logged. An attacker or a malicious administrator with an account on the bypass list can read and change mail with no record in the audit log.

Remove the bypass from every account and reduce the noise in another way, for example by filtering the audit log when you search it.

Note: This test is LongRunning. It reads the audit bypass setting of every mailbox and recipient, which can take a long time in large tenants. Use Invoke-Maester -IncludeLongRunning to run it, or select it by ID.

Remediation action

1. Connect to Exchange Online with Connect-ExchangeOnline.
2. List the accounts with Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled }.
3. For each account run Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $false.

Related links

• Manage mailbox auditing
• Set-MailboxAuditBypassAssociation
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.3

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.6.1.3
Severity	Medium
Suite	CIS
Product	Exchange Online
Feature	Mailbox auditing
Area	Logging and detection
Resource type	Mailbox
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.3
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.1.3, nist-800-53-r5:AU-12
PowerShell test	Test-MtCisMailboxAuditBypass
Services	ExchangeOnline
Long running	Yes

Source

• Test: tests/cis/Test.CIS.M365.6.1.3.ps1
• Documentation: tests/cis/Test.CIS.M365.6.1.3.md