CISA.MS.EXO.13.1: Mailbox auditing SHALL be enabled.
| ID | CISA.MS.EXO.13.1 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Feature | Mailbox auditing |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.13.1 (SHALL) |
| Framework controls | cisa-scuba:MS.EXO.13.1nist-800-53-r5:AU-12c Audit Record Generation |
| MITRE ATT&CK | T1070.008, T1098.002, T1564.008, T1586.002, T1685.002 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Mailbox auditing SHALL be enabled.
Rationale: Exchange Online user accounts can be compromised or misused. Enabling mailbox auditing provides a valuable source of information to detect and respond to mailbox misuse.
Remediation action
Section titled “Remediation action”Mailbox auditing can be managed from the Exchange Online PowerShell module. Follow the instructions listed on Manage mailbox auditing in Office 365.
- To enable mailbox auditing by default for your organization via PowerShell:
- Connect to the Exchange Online PowerShell.
- Run the following command:
Set-OrganizationConfig –AuditDisabled $false
Related links
Section titled “Related links”- Microsoft Learn - Mailbox Auditing
- CISA 13 Mailbox Auditing - MS.EXO.13.1v1
- CISA ScubaGear Rego Reference
Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.