# (L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes

(L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes. A Maester check for Exchange Online, Mailbox auditing.

Source: https://maester.dev/docs/tests/CIS.M365.6.1.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Mailbox auditing · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.1.3
```

## Overview

No account is configured to bypass mailbox audit logging.

Audit bypass is meant for service accounts that generate a lot of noise, such as a monitoring or journaling account. Anything such an account does in any mailbox is not logged. An attacker or a malicious administrator with an account on the bypass list can read and change mail with no record in the audit log.

Remove the bypass from every account and reduce the noise in another way, for example by filtering the audit log when you search it.

> **Note:** This test is `LongRunning`. It reads the audit bypass setting of every mailbox and recipient, which can take a long time in large tenants. Use `Invoke-Maester -IncludeLongRunning` to run it, or select it by ID.

#### Remediation action

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. List the accounts with `Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled }`.
3. For each account run `Set-MailboxAuditBypassAssociation -Identity <account> -AuditBypassEnabled $false`.

#### Related links

* [Manage mailbox auditing](https://learn.microsoft.com/purview/audit-mailboxes)
* [Set-MailboxAuditBypassAssociation](https://learn.microsoft.com/powershell/module/exchange/set-mailboxauditbypassassociation)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.3](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.1.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mailbox auditing |
| Area | Logging and detection |
| Resource type | Mailbox |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.1.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.1.3, nist-800-53-r5:AU-12 |
| PowerShell test | [Test-MtCisMailboxAuditBypass](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.3.ps1) |
| Services | ExchangeOnline |
| Long running | Yes |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.1.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.1.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.1.3.md)