Last week I explained how to retrieve the list of auditing disabled mailboxes. This week I'll explain how to enable mailbox auditing in a few clicks.
Time-consuming PowerShell scripts
By default mailbox auditing is disabled in Exchange Online, and there is no provisioning in the Microsoft 365 portal to enable it. Administrators have to enable auditing for each individual mailbox that should be audited using PowerShell scripts, and also select the actions that should be audited. This makes the PowerShell scripts longer and longer. Imagine the amount of time that needs to be invested in a large organization.
M365 Manager Plus to the rescue
With M365 Manager Plus' management feature you can enable auditing for any number of mailboxes in a user-friendly UI. As a prerequisite, retrieve the list of auditing disabled mailboxes and export them to a CSV file. [Refer this post]
- Go to Management tab.
- Select Mailbox Management under Exchange Online in the left pane.
- Select Mailbox Audit Settings under Exchange Mailbox Limit. [Refer image below]
- In Mailbox Audit Settings page, select the Microsoft 365 Tenant, and choose Enabled for Mailbox Audit.
- Select the actions to be audited for a delegate, mailbox owner, and admin in the respective drop-downs. [Multiple actions can be selected].
- Enter how long the audit logs should be retained, in Audit Log Age Limit (in days) field.
- In Find Mailboxes to Modify section, choose CSV Import to upload the CSV file you had saved earlier. [You can also choose Enter names to search and use the Browse option to sleect the mailboxes manually from the list of mailboxes shown.]
- Click Apply.
That's it, you have enabled auditing for a list of mailboxes in a jiffy, which is highly unlikely in the native portal. Next week, I'll show you some important actions that you should not miss to audit.
