2019-01-07

Updated feature: Exchange Online mailbox audit to add mail reads by default

Exciting news in the world of Office 365 Business Email Compromise investigations. Following on from their recent commitment to improve logging of account activity within Office365 Microsoft have announced that Exchange Online will audit mail reads/accesses by default for owners, admins and delegates under the MailItemsAccessed action.

I was notified as part of the weekly 'Office 365 changes' roundup sent to Office365 administrators, the text of the update reads:

Updated feature: Exchange Online mailbox audit to add mail reads by default
MC171679
Prevent or Fix Issues
Published On : 4 January 2019
To ensure that you have access to critical audit data to investigate security incidents in your organization, we’re making some updates to Exchange mailbox auditing. After this change takes place, Exchange Online will audit mail reads/accesses by default for owners, admins and delegates under the MailItemsAccessed action.
This message is associated with Microsoft 365 Roadmap ID: 32224.
How does this affect me?
The MailItemsAccessed action offers comprehensive forensic coverage of mailbox accesses, including sync operations. In February 2019, audit logs will start generating MailItemsAccessed audit records to log user access of mail items. If you are on the default configuration, the MailItemsAccessed action will be added to Get-mailbox configurations, under the fields AuditAdmin, AuditDelegate and AuditOwner. Once the feature is rolled out to you, you will see the MailItemsAccessed action added and start to audit reads. 
This new MailItemsAccessed action is going to replace the MessageBind action; MessageBind will no longer be a valid action to configure, instead an error message will suggest turning on the MailItemsAccessed action. This change will not remove the MessageBind action from mailboxes which have already have added it to their configurations. 
Initially, these audit records will not flow into the Unified Audit Log and will only be available from the Mailbox Audit Log. 
We’ll begin rolling this change out in early February, 2019. If you are on the default audit configuration, you will see the MailItemsAccessed action added once the feature is rolled out to you and you start to audit reads. 
What do I need to do to prepare for this change?
There is no action you need to take to derive the security benefits of having mail read audit data. The MailItemsAccessed action will be updated in your Get-Mailbox action audit configurations automatically under AuditAdmin, AuditDelegate and AuditOwner. 
If you have set these configurations before, you will need to update them now to audit the two new mailbox actions. Please click Additional Information for details on how to do this. 
If you do not want to audit these new actions in your mailboxes and you do not want your mailbox action audit configurations to change in the future as we continue to update the defaults, you can set AuditAdmin, AuditDelegate and AuditOwner to your desired configuration. Even if your desired configuration is exactly the same as the current default configuration, so long as you set the AuditAdmin, AuditDelegate and AuditOwner configurations on your mailbox, you will preclude yourself from further updates to these audit configurations. Please click Additional Information for details on how to do this.
If your organization has turned off mailbox auditing, then you will not audit mail read actions.
This is good news for investigating the scope of account compromise, of course it should be noted that there are a number of other concerns, and indeed other ways that messages can be downloaded/accessed, once an account has been compromised.

Once my O365 test account has been updated with the change I plan to do some testing of this additional logging and will document any findings here.

Relevant reading:

16 comments:

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. You have shared amazing post. This post is really helpful for us to know the information. Thank you for taking your time to post such a wonderful article. Get for more information Physicians Email List

    ReplyDelete
    Replies
    1. Keep on following such a great post sir .

      https://kbcinquiryoffice.blogspot.com

      Delete
  3. Great job for publishing such a nice article. Your article isn’t only useful but it is additionally really informative. Thank you because you have been willing to share information with us. Fedex Audit

    ReplyDelete
    Replies
    1. Sure , I am agree with your knowledgeable ideas.

      https://kbcinquiryoffice.blogspot.com

      Delete
  4. Get the information about the kbc lottery winner. We are sharing important information with KBC lucky customers about the lottery. We provides the important information about KBC Lottery and its Winner List at kbc Lottery Check

    ReplyDelete
  5. Buy Fresh Fruits Online from SabjiKiranaStore at a low price. We bring you fresh fruit delivery that's all about deliciousness and variety.So enjoy your favorite fruit by ordering today! fruit delivery in jaipur

    ReplyDelete
    Replies
    1. Sure, I have same ideas like you .


      https://kbcinquiryoffice.blogspot.com

      Delete
  6. Hire the Professionalmalta photographer at Friendly Budget, At FBalzan our best wedding photographers in Malta offers professional wedding photography services. Check out our wedding photography pricing & packages!

    ReplyDelete
    Replies
    1. I have same ideas like you .


      https://kbcinquiryoffice.blogspot.com

      Delete
  7. Its a great and tremendous blog post.


    https://kbcinquiryoffice.blogspot.com

    ReplyDelete
  8. Keep on sharing and writing such a good and beneficial post.

    https://kbclotterywinnerlistjio.blogspot.com

    ReplyDelete
  9. This comment has been removed by the author.

    ReplyDelete
  10. I am getting benefits from the blog and article for quality knowledge.

    https://bolgameshowluckydraw.blogspot.com

    ReplyDelete
  11. So nice and knowledgeable post.


    https://kbcluckywinner4.blogspot.com

    ReplyDelete
  12. What a great idea and thoughts you have .


    https://kbcinquiryoffice.blogspot.com

    ReplyDelete