Microsoft 365
TMA-M365-6.1.3
Ensure 'AuditBypassEnabled' is not enabled on mailboxes
Açıklama
When configuring a user or computer account to bypass mailbox audit logging, the system will not record any access, or actions performed by the said user or computer account on any mailbox. Administratively this was introduced to reduce the volume of entries in the mailbox audit logs on trusted user or computer accounts. Ensure AuditBypassEnabled is not enabled on accounts without a written exception. If a mailbox audit bypass association is added for an account, the account can access any mailbox in the organization to which it has been assigned access permissions, without generating any mailbox audit logging entries for such access or recording any actions taken, such as message deletions. Enabling this parameter, whether intentionally or unintentionally, could allow insiders or malicious actors to conceal their activity on specific mailboxes. Ensuring proper logging of user actions...
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
To audit using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. Run the following PowerShell command: $MBXData = Get-MailboxAuditBypassAssociation -ResultSize unlimited $Report = $MBXData | ? {$_.AuditBypassEnabled -eq $true} | select Name,AuditBypassEnabled $Report <# Optional: Export methods $Report | Out-GridView -Title "Mailbox Audit Bypass Association" $Report | Export-Csv -Path "6.1.3.csv" -NoTypeInformation #> 3. If nothing is returned, then there are no accounts with Audit Bypass enabled. Note: The cmdlet Get-MailboxAuditBypassAssociation may display a WARNING on system objects that begin with "Asc-2X1", this is not part of the Audit procedure and can be ignored.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
To remediate using PowerShell: 1. Connect to Exchange Online using Connect-ExchangeOnline. 2. The following example PowerShell script will disable AuditBypass for all mailboxes which currently have it enabled: # Get mailboxes with AuditBypassEnabled set to $true $MBXAudit = Get-MailboxAuditBypassAssociation -ResultSize unlimited | Where- Object { $_.AuditBypassEnabled -eq $true } foreach ($mailbox in $MBXAudit) { $mailboxName = $mailbox.Name Set-MailboxAuditBypassAssociation -Identity $mailboxName - AuditBypassEnabled $false Write-Host "Audit Bypass disabled for mailbox Identity: $mailboxName" - ForegroundColor Green }
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- loggingm365saas
- Referans
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.1.3 Ensure 'AuditBypassEnabled' is not enabled on mailboxes