Mailbox auditing SHALL be enabled.

Why This Matters

When mailbox auditing is disabled, your organization loses visibility into user actions such as message deletions, folder moves, and permissions changes. This blind spot makes it difficult to detect compromised accounts, insider threats, or compliance violations. Enabling mailbox auditing provides a critical forensic trail for security investigations and regulatory audits.

What Aether365 Checks

Aether365 verifies that mailbox auditing is enabled for all user mailboxes in your Microsoft 365 tenant. This check appears in the Aether365 dashboard under the microsoft-365 checks section.