Mailboxes are a treasure trove of personal data and insider business information, especially if the mailbox belongs to the top brass in your organization. Some of the first things an intruder does after infiltrating a network is attempt to identify accounts that have elevated permissions and grant themselves access to the mailboxes of those accounts. They may even block everyone else's access to these mailboxes, causing mayhem.
How to audit Exchange Online mailboxes
By default, mailbox auditing is disabled for all Exchange Online mailboxes. You need to enable auditing for Exchange mailboxes manually to view audit logs. The native Microsoft 365 portal doesn't offer any way to enable auditing for mailboxes in bulk; you either need to individually enable auditing for each and every mailbox, or use PowerShell scripting to automate the process.
But even if you are well-versed in scripting, this process would still be time-consuming if you have a significant number of mailboxes in your organization. This is where M365 Manager Plus comes into play. With M365 Manager Plus, you can enable auditing for any number of mailboxes in just a few clicks—all without a single PowerShell script. You can:
- Identify which mailboxes have auditing disabled.
- Enable mailbox auditing.
Mailbox permissions to audit
Mailbox permissions are used to grant access to the contents of a mailbox; this includes not only the inbox but also the mailbox folders, calendar, and contacts. This is why caution should be maintained when granting mailbox permissions to delegates, so a user doesn't receive elevated privileges unless they need them.
The following permissions can be assigned to delegates:
| Permission |
Description |
| Full Access |
Authorizes the delegates to open the mailbox, as well as view, add, and remove content. They won't, however, be able to send emails from the mailbox. |
| Send As |
Authorizes delegates to send emails from the delegated mailbox or group without revealing their identity. The emails sent appear as if they were sent from the delegated mailbox or group. |
| Send on Behalf |
Authorizes delegates to send emails from the delegated mailbox or group; these emails clearly show the identity of the sender. However, replies will be sent to the delegated mailbox or group. |
How to audit mailbox permission changes with M365 Manager Plus
With M365 Manager Plus you can:
Microsoft 365 auditing
