Hello Reader,

We're getting close to summer (it's sort of already here in Florida...I'm writing this as the kids are swimming in the pool). It's also getting close to the Microsoft 365 Conference in Orland (it's only about two weeks away)! Regardless of whether you're going or not, there will also be some announcements around that time, so keep an eye on the Microsoft blogs at the end of this month!

💡A Microsoft 365 Management Tip: Auditing Exchange Online Mailboxes

Auditing Microsoft 365 activities is always an interesting topic of conversation whether it's auditing for security, compliance, or just figuring out what happened to a file in SharePoint. The Microsoft 365 Audit log audits 380+ activities across Microsoft 365. One of the most interesting activities is mail in Exchange Online Mailboxes. In fact, during this month's Office Hours with Q&A, I showed some of the uniqueness of auditing mailboxes. You can catch that segment of the office hours here:

So, what makes it unique? First, there are three different permissions when it comes to mailboxes: Admin, Owner, Delegated. Admin is something like an admin running an eDiscovery or impersonation; Owner is the person whose mailbox it is; Delegate is someone who's been granted permissions to someone else mailbox. While all mailbox actions are audited, they aren't all audited the same for each permissions level as seen in this table. Along with this, you can change activities that are audited for the various permissions as well; further down in that article here, you can see the PowerShell scripts you can use to modify the activities logged for the various permissions levels as well as set them back to the default.

One last important thing to note is that turning some of those on for Owners can have other unintended consequences. It isn't mentioned in the documentation above, but looking at the troubleshooting documentation, we find, "By default, only non-owner mailbox audit logging is enabled, and owner mailbox audit logging is disabled. If you have to perform owner mailbox audit logging to investigate a specific issue, you can temporarily enable the process for a two-week period." And, "It should be used for a limited time period, approximately two weeks. This is because the audit log entries are stored in the mailbox, and this may cause the mailbox dumpster to exceed the size limit." It also contains more samples for turning it it on and off...but...yeah, you read that right. The audit logs for mailbox owner activities take up space in the mailbox for deleted items. So, keeping this on too long can fill up the deleted items in a user mailbox.

So, unfortunately, certain activities a user may take on their own mailbox aren't continuously audited, and while you can turn it on, it shouldn't be left on indefinitely. Hopefully, that helps you understand a little bit more about mailbox auditing in Exchange Online

Would you like to become the go-to Microsoft 365 gal or guy at your company? Let me know!​

So back to Intelligink updates, what’s ahead in 2024…

• May 2024 Office Hours!! We'll have more news, a live demo of a tip or trick, and time for Q&A! Keep an eye on your email for the day and time. In the meantime, reply to this email with any questions you want me to add to next month's office hours!
• April 2024 Office Hours replay? Watch the entire live Office hours here (it also includes the short segment about email auditing above).

🗞️ Microsoft 365 news highlights

• ​Basic Auth for SMTP Auth in Exchange Online is going away soon! The writing has been on the wall as Microsoft has slowly eliminated Basic Auth. This is one more step in fully removing it from Exchange Online.
• ​What's new in Entra - Hightlighted updates, roadmap, and changes in Microsoft Entra, all located in one place in the Entra Admin Center.

​

Thank you all, and have a great day!

Ben Stegink

Helping you become a Microsoft 365 Expert!

​