Admin: Mailbox accessed via Content search, eDiscovery or Microsoft Exchange Mapi Editor.

There are three different types of operations: The different operations are documented here:

Let’s say we create a new user the following auditoptions are set: Checking mailbox audit settings Which audit operations are set seems to depend on the license level (business vs e3 vs e5). After a new mailbox is created we need to set which mailbox operations are logged. This forces the administrator to set them per user. Unfortunately we cannot set a standard set of operations that are logged for every mailbox. Mailbox Audit settings describe which operations on the mailbox are logged. Make sure you can detect any modifications to the UnifiedAuditLogIngestionEnabled setting. Enabling can be done via: “Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true” Audit log settings It can be checked using “Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled”. If you use o365 just make sure to enable it. The unified audit log is a combination of logging from SharePoint, Exchange Online, Teams and more. Essentially we need to make sure Unified Audit log is enabled and the mailbox audit settings are set correctly. There’s some things you need to be wary of when relying on the o365 logging. Office 365 audit logging can be tricky to manage. Especially when it comes to mailbox operations and logging. However there are some things to take into consideration. You can enable the unified audit log and be done. However there are some important things to take into consideration.

The audit log is not always enabled by default, it seems to rely on license levels. Atleast if you get hacked there’s logging to investigate :). It’s important to enable audit logging for o365 even if you are not monitoring them actively.

Azure ad audit logs