Mailbox Audit

Mailbox audit in Exchange Online records administrative and user actions on mailboxes — message reads, sends, moves, deletes, mailbox sign-ins, folder permission changes — to the Unified Audit Log (Microsoft Purview). Different actor types — Owner (the mailbox owner), Delegate (someone with permissions), and Admin (administrators) — have different default-audited actions. Default mailbox audit is on for all mailboxes; admins can customise which specific actions are audited. The most useful Exchange audit category for investigating mailbox compromise (suspicious sign-ins, rule creation, mass mail movement). Configured via Exchange Online PowerShell with the Set-Mailbox cmdlet's audit-related parameters.