Automate Mailbox Auditing in Office 365

Introduction

For most organizations, Office 365 (mailboxes) can contain both high business impact and personally identifiable information, so it’s important that we track who logs on to the mailboxes in the organization and what actions are taken. By default, mailbox auditing in Office 365 isn’t turned on, so this guide will help you to setup and verify mailbox auditing in Office 365.

This guide will walk you through the following steps:

• Step 1: Connect to Exchange Online
• Step 2: Get the current state of audit logging
• Step 3: Enable mailbox audit logging
• Step 4: Set the age limit for mailbox audit logging
• Step 5: Automate the process using Azure Automation

Connect to Exchange Online

All Office 365 Tenant Admins should have multi-factor authentication (MFA) enabled, and if you want to connect to Exchange Online PowerShell, you need to install the Exchange Online Remote PowerShell Module, and use the Connect-EXOPSSession cmdlet to connect.

The Exchange Online Remote PowerShell Module must be installed on your computer, and is available from the Exchange admin center (EAC).

Here is a detailed install guide:
https://technet.microsoft.com/en-us/library/mt775114(v=exchg.160).aspx

Now you can launch the Exchange Online Remote PowerShell Module, and use the following command to connect to Exchange Online:

Connect-EXOPSSession -UserPrincipalName <UPN>

Get the current state of audit logging

Before we enable Mailbox Auditing for all our users, we might want to see the current configuration for each mailbox. This is also a good way to verify that it actually works. This can be done by running the following PowerShell command:

Get-Mailbox -Filter {RecipientTypeDetails -eq “UserMailbox”} | Select Name,AuditEnabled

As you can see, not all of my users have mailbox audit enabled. We need to fix that!

Enable mailbox audit logging

Now we’ll use PowerShell to enable mailbox audit logging for all user mailboxes in the organization.
This can be done by running the following PowerShell command:

Get-Mailbox -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditEnabled $True

If we then run the first PoweShell command again, we can check the status again.
Now all user mailboxes should now have mailbox audit logging enabled.

Set the age limit for mailbox audit logging

By default, entries in the mailbox audit log are kept for 90 days. So, when an entry is older than 90 days, it’s deleted. Many organizations would like change that to 180 or maybe even 365 days. This can be configured by using the Set-Mailbox cmdlet to change the setting so items are kept for a longer period.

This example increases the age limit for mailbox audit log entries for all user mailboxes in the organization to 365 days.

Get-Mailbox -Filter {RecipientTypeDetails -eq “UserMailbox”} | Set-Mailbox -AuditLogAgeLimit 365

Automate the process using Azure Automation

Now mailbox auditing is configured like we want it for all our current users. But what about new users? The commands we used to enable and configure mailbox auditing, won’t affect all new users that we create in the future. That means that we need to remember to set this for all new users that we create.

Or we can do it like a boss! We can automate the process, and catch all users that we “forget” to configure correctly. And the easiest (and coolest) way to do that, is by using Azure Automation.

If this is the first time you’re using Azure Automation, you need to start by creating an Azure Automation Account. More Information: https://docs.microsoft.com/en-us/azure/automation/automation-create-standalone-account

Next, you need to create an Credential Assets, that can execute your Runbooks. More information: https://docs.microsoft.com/en-us/azure/automation/automation-credentials

Now you should be ready to create the Azure Automation Runbook.
Select Runbooks and Click Add a Runbook.

Add a Name to the Runbook, and select PowerShell as the Runbook Type. Click Create.

Use the following script (don’t forget to change the “AAD Service Account” to the name of your credentials):

# ----------------------------------------------------------------------------- 
# Author: Ronni Pedersen, Microsoft MVP: Enterprise Mobility
# Blog: https://www.ronnipedersen.com 
# Twitter: @ronnipedersen 
# Date: 29/07-2017
# ----------------------------------------------------------------------------- 
# Enable Mailbox Auditing for Office 365 Users
# ----------------------------------------------------------------------------- 

#Connect to Azure Automation
$Credentials = Get-AutomationPSCredential -Name 'AAD Service Account'

# Function: Connect to Exchange Online 
function Connect-ExchangeOnline {
    param (
        $Creds
    )
        Write-Output "Connecting to Exchange Online"
        Get-PSSession | Remove-PSSession       
        $Session = New-PSSession –ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $Creds -Authentication Basic -AllowRedirection
        $Commands = @("Get-MailboxFolderPermission","Set-MailboxFolderPermission","Set-Mailbox","Get-Mailbox","Set-CalendarProcessing","Add-DistributionGroupMember")
        Import-PSSession -Session $Session -DisableNameChecking:$true -AllowClobber:$true -CommandName $Commands | Out-Null
    }

# Connect to Exchange Online
Connect-ExchangeOnline -Creds $Credentials

# Enable Mailbox Audit for All Users
Write-Output "Enable Mailbox Audit for all Users"
Get-Mailbox -Filter {RecipientTypeDetails -eq "UserMailbox" -and AuditEnabled -eq $False} | Set-Mailbox -AuditEnabled $True

# Set AuditLogAgeLimit to 1 year
Write-Output "Set Mailbox Audit Log Age Limit for all Users"
Get-Mailbox -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditLogAgeLimit 365

# Close Session
Get-PSSession | Remove-PSSession

Write-Output "Script Completed!"

Important: Don’t forget to schedule the runbook to run every night.

That’s it…

+Ronni Pedersen