Microsoft 365
TMA-M365-6.1.3
Ensure 'AuditBypassEnabled' is not enabled on mailboxes
Deskripsi
When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts. Ensure AuditBypassEnabled is not enabled on accounts without a written exception. If a mailbox audit bypass association is added for an account, the account can access any mailbox in the organization to which it has been assigned access permissions, without generating any mailbox audit logging entries for such access or recording any actions taken, such as message deletions. Enabling this parameter, whether intentionally or unintentionally, could allow insiders or malicious actors to conceal their activity on specific mailboxes. Ensuring proper logging of user actions...
Cara pemeriksaan
Metode audit: Tinjauan manual
To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: $MBXData = Get-MailboxAuditBypassAssociation -ResultSize unlimited $Report = $MBXData | ? {$_.AuditBypassEnabled -eq $true} | select Name,AuditBypassEnabled $Report <# Optional: Export methods $Report | Out-GridView -Title "Mailbox Audit Bypass Association" $Report | Export-Csv -Path "6.1.3.csv" -NoTypeInformation #> 3. If nothing is returned, then there are no accounts with Audit Bypass enabled. Note: The cmdlet Get-MailboxAuditBypassAssociation may display a WARNING on system objects that begin with "Asc-2X1", this is not part of the Audit procedure and can be ignored.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. The following example PowerShell script will disable AuditBypass for all mailboxes which currently have it enabled: # Get mailboxes with AuditBypassEnabled set to $true $MBXAudit = Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where- Object { $_.AuditBypassEnabled -eq $true } foreach ($mailbox in $MBXAudit) { $mailboxName = $mailbox.Name Set-MailboxAuditBypassAssociation -Identity $mailboxName - AuditBypassEnabled $false Write-Host "Audit Bypass disabled for mailbox Identity: $mailboxName" - ForegroundColor Green }
Properti
- Sistem operasi
- Apa saja
- Tag
- loggingm365saas
- Referensi
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes