Skip to content

Microsoft 365 logging & audit security checks

Audit logs, event retention and incident-response hooks — the evidence you need when something goes wrong, and the controls auditors ask for first.

On Microsoft 365, Black Cat runs 8 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft 365 connector needs.

Checks (8)

severity: high Global Mailbox Auditing Disabled fix difficulty: easy #

Enable global mailbox auditing in M365 Exchange Online via PowerShell

  1. Connect to Exchange Online PowerShell
  2. Run Set-OrganizationConfig -AuditDisabled $false
  3. Verify with Get-OrganizationConfig | Select AuditDisabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high Mailbox Audit Bypass Configured fix difficulty: easy #

Remove mailbox audit bypass configuration from M365 accounts to restore full audit trail

  1. Connect to Exchange Online PowerShell
  2. Run Set-MailboxAuditBypassAssociation -Identity <user> -AuditBypassEnabled $false
  3. Verify with Get-MailboxAuditBypassAssociation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Mailbox Auditing Disabled fix difficulty: easy #

Enable mailbox auditing for M365 users with comprehensive audit actions

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -AuditEnabled $true
  3. 'Configure audit actions: Set-Mailbox -AuditOwner, -AuditDelegate, -AuditAdmin as needed'
  4. Verify with Get-Mailbox -Identity <user> | Select Audit*

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low Shared Mailbox Sent-As Not Audited fix difficulty: easy #

Enable sent-as message copy for M365 shared mailboxes to preserve audit trail

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <shared_mailbox> -MessageCopyForSentAsEnabled $true
  3. Verify with Get-Mailbox | Select MessageCopyForSentAsEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low Shared Mailbox Sent-On-Behalf Not Audited fix difficulty: easy #

Enable sent-on-behalf message copy for M365 shared mailboxes to preserve audit trail

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <shared_mailbox> -MessageCopyForSendOnBehalfEnabled $true
  3. Verify with Get-Mailbox | Select MessageCopyForSendOnBehalfEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low Non-Shared Mailbox Audit Bypass fix difficulty: easy #

Remove audit bypass configuration from M365 non-shared mailboxes

  1. Connect to Exchange Online PowerShell
  2. Run Set-MailboxAuditBypassAssociation -Identity <user> -AuditBypassEnabled $false
  3. Verify the non-shared mailbox no longer bypasses audit

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium User Mailbox Auditing Disabled fix difficulty: easy #

Enable auditing for M365 user mailboxes with comprehensive admin and delegate audit actions

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -AuditEnabled $true
  3. Configure comprehensive audit actions for admin, delegate, and owner
  4. Verify with Get-Mailbox | Select Audit*

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high Unified Audit Log Not Enabled fix difficulty: easy #

Enable the M365 Unified Audit Log to capture all tenant activity for compliance and forensics

  1. Navigate to Microsoft Purview Compliance Portal > Audit
  2. Click Start Recording User and Admin Activity if not already enabled
  3. Verify audit log search returns recent events

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

More Microsoft 365 checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial