# How do you use the Microsoft 365 audit log to investigate an email incident?

URL: https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Use Microsoft Purview Audit to investigate a hacked mailbox: MailItemsAccessed, Send, inbox rule and forwarding events, retention and Search-UnifiedAuditLog.

## Short answer

Search Microsoft Purview Audit for the compromised user over the attack window. Look for New-InboxRule and UpdateInboxRules (hidden rules), Set-Mailbox with ForwardingSmtpAddress (forwarding), Send (mail the attacker sent) and MailItemsAccessed (what they read). Audit (Standard) keeps records for 180 days; Audit (Premium) keeps Exchange records for one year by default.

When a mailbox is compromised, message trace tells you what mail flowed. The audit log tells you what the attacker *did*: which rules they created, where they forwarded mail, what they sent and what they read. This guide covers where to search, which events matter, how long records last, and a step-by-step investigation.

## What is the Microsoft 365 audit log?

Microsoft Purview Audit records user and admin activity across Microsoft 365 in one unified audit log. Microsoft says it "captures, records, and retains thousands of user and admin operations performed in dozens of Microsoft services" ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)). For email, two kinds of record matter:

- **Mailbox audit records:** actions inside a mailbox, such as sending, deleting, accessing mail and changing inbox rules.
- **Exchange admin records:** cmdlets that change configuration, such as `Set-Mailbox`. Microsoft notes that cmdlets beginning with `Get-`, `Search-` or `Test-` aren't recorded.

### Is auditing turned on?

Both layers are on by default, but check rather than assume.

Unified audit log search is on by default for enterprise organizations. In Exchange Online PowerShell, run:

```powershell
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
```

`True` means it's on. Microsoft warns that running this in Security & Compliance PowerShell always shows `False`, so use Exchange Online PowerShell ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-search)).

Mailbox audit logging "is turned on by default in all organizations" ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-mailboxes)). Microsoft says it turned this on for all Office 365 and Microsoft 365 organizations starting in January 2019 ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios)). Check it with:

```powershell
Get-OrganizationConfig | Format-List AuditDisabled
```

`False` means mailbox auditing is on. It covers user, shared and Microsoft 365 Group mailboxes.

One catch: Microsoft says mailbox audit events "return only for users with E5 licenses" in some searches. For other users it recommends running `Set-Mailbox -Identity <mailbox> -AuditEnabled $true` on the mailbox, and toggling it off and on if searches still return nothing ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios)). Do this now for key mailboxes, not during an incident.

## Audit (Standard) vs Audit (Premium): how long are records kept?

| Capability | Audit (Standard) | Audit (Premium) |
|---|---|---|
| Enabled by default | Yes | Yes |
| Audit search, Search-UnifiedAuditLog, CSV export | Yes | Yes |
| Default retention | 180 days | 1 year for Exchange, SharePoint, OneDrive and Entra ID; 180 days for others |
| Custom audit log retention policies | No | Yes, up to 1 year (10 years with add-on) |
| Export limit from the search UI | 50,000 rows | 1,000,000 rows |
| Intelligent insights (such as sensitivity labels on accessed mail) | No | Yes |

Sources: [Microsoft Learn: auditing solutions](https://learn.microsoft.com/en-us/purview/audit-solutions-overview) and [Microsoft Learn: search the audit log](https://learn.microsoft.com/en-us/purview/audit-search), at the time of writing (October 2026).

The 180-day Standard retention is fairly recent. Microsoft says records created before October 17, 2023 were kept for 90 days, and records from that date on are kept for 180 days.

Premium's one-year retention applies to users with Office 365 E5, Microsoft 365 E5, Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance) or the E5 eDiscovery and Audit add-on. Everyone else gets 180 days. Business email compromise is often discovered months later, when a supplier chases an unpaid invoice, so 180 days can be tight. If you might need longer, export records to your own storage or a SIEM through the Office 365 Management Activity API.

## Which audit events matter for email incidents?

| Activity (friendly name) | Operation | What it tells you |
|---|---|---|
| Created new inbox rule in Outlook web app | `New-InboxRule` | A rule was created in Outlook on the web or PowerShell |
| Modified inbox rule from Outlook web app | `Set-InboxRule` | An existing rule was changed |
| Updated inbox rules from Outlook client | `UpdateInboxRules` | A rule was created, changed or removed from desktop Outlook |
| (Exchange admin cmdlet) | `Set-Mailbox` | Mailbox settings changed, including forwarding |
| Added delegate mailbox permissions | `Add-MailboxPermission` | Someone was given FullAccess to a mailbox |
| Sent message | `Send` | A message was sent, replied to or forwarded |
| Sent message using Send As permissions | `SendAs` | Another user sent as the mailbox owner |
| Accessed mailbox items | `MailItemsAccessed` | Mail was read or synced by a client or protocol |
| User signed in to mailbox | `MailboxLogin` | A sign-in to the mailbox |

Names come from Microsoft's [audit activities list](https://learn.microsoft.com/en-us/purview/audit-log-activities) and [mailbox auditing page](https://learn.microsoft.com/en-us/purview/audit-mailboxes). By default, mailbox auditing logs `Send`, `MailItemsAccessed`, `UpdateInboxRules`, `SoftDelete`, `HardDelete` and several others for owners. `MailboxLogin` and `SearchQueryInitiated` aren't logged by default; you add them with `Set-Mailbox -AuditOwner @{Add="MailboxLogin"}`.

### Inbox rules and forwarding

Rules and forwarding are how attackers hide replies and keep copying mail after a password reset. Our guide to [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) shows how to find the rules that exist now. The audit log adds *when* they were made and *from where*.

In a `New-InboxRule` record, Microsoft says the **ObjectId** field shows the rule name, **Parameters** shows its conditions and actions (such as `MoveToFolder`), and **UserId** shows who created it ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios)).

Forwarding set on the mailbox itself shows up as `Set-Mailbox`. In **Parameters**, `ForwardingSmtpAddress` is the destination. If `DeliverToMailboxAndForward` is `True`, a copy stays in the mailbox; if `False`, mail only goes to the forwarding address.

### MailItemsAccessed: what did the attacker read?

`MailItemsAccessed` covers "all mail protocols: POP, IMAP, MAPI, EWS, Exchange ActiveSync, and REST" ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts)). Microsoft describes it as part of Audit (Standard) and "enabled by default for users that are assigned an Office 365 E3/E5 or Microsoft 365 E3/E5 license." If your users have other plans, check with `Get-Mailbox <user> | Select-Object -ExpandProperty AuditOwner`.

It records two kinds of access:

- **Bind:** one message opened. Records list each message's `InternetMessageId`, with binds in a 2-minute interval grouped into one record.
- **Sync:** desktop Outlook downloading a folder. Microsoft says "all mail items in the synced folder are assumed to be compromised."

To separate the attacker from the real user, compare `ClientIPAddress`, `ClientInfoString` and `SessionId` with the attacker's sign-in. If a sync came from the attacker's context, Microsoft's advice is to assume they "synced all mail items to their client, which means the entire mailbox is compromised." That matters if the mailbox held personal, health or financial data you may have to report.

## How do you search the audit log?

### In the Microsoft Purview portal

You need the **Audit Logs** or **View-Only Audit Logs** role. By default the Audit Reader and Audit Manager role groups have them ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios)).

1. Sign in to the [Microsoft Purview portal](https://purview.microsoft.com) and open the **Audit** solution.
2. Set the **Date and time range (UTC)**. The default is the last seven days, and the maximum range is 180 days.
3. Enter operation names in **Activities - operations names**, for example `New-InboxRule,Set-InboxRule,UpdateInboxRules,Send`. Names must be exact.
4. Add the compromised account under **Users**.
5. Name the search and select **Search**. Jobs keep running after you close the browser, and completed jobs are kept for 30 days.
6. Open a result for its details, or **Export** to CSV.

For forwarding changes, leave activities blank, then filter the results to `Set-Mailbox`.

### With Search-UnifiedAuditLog

The `Search-UnifiedAuditLog` cmdlet runs in Exchange Online PowerShell. By default it returns only 100 records; `-ResultSize` goes up to 5,000, and `-SessionCommand ReturnLargeSet` pages through up to 50,000 unsorted results ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/search-unifiedauditlog)). Dates are in UTC.

```powershell
Search-UnifiedAuditLog -StartDate "2026-09-01" -EndDate "2026-10-10" `
  -UserIds user@example.com `
  -Operations New-InboxRule,Set-InboxRule,UpdateInboxRules,Send,MailItemsAccessed `
  -SessionId "incident-001" -SessionCommand ReturnLargeSet -ResultSize 5000 |
  Export-Csv incident-001.csv -NoTypeInformation
```

Run the same command with the same `SessionId` until it returns nothing. The details sit in the `AuditData` column as JSON.

Searching by user won't show what a delegate did in that mailbox, or activity in a shared mailbox. For that, Microsoft suggests searching by the mailbox's GUID: `-FreeText (Get-Mailbox <mailbox>).ExchangeGuid`.

## Step-by-step: investigating a compromised mailbox

Contain the account first, using the steps in [signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised). Then:

1. **Set the window.** Start a few days before the first suspicious sign-in or phishing click, and end now.
2. **Find the attacker's IP addresses.** Search the user's activity and note IP addresses and clients that don't match the user's normal pattern.
3. **Search rule and forwarding changes** (`New-InboxRule`, `Set-InboxRule`, `UpdateInboxRules`, `Set-Mailbox`, `Add-MailboxPermission`). Record each rule's name and actions, and each forwarding address.
4. **Search `Send` records** from the attacker's IPs and sessions to list what they sent, and to whom. Cross-check with [message trace](https://iblockspam.com/blog/microsoft-365-message-trace).
5. **Search `MailItemsAccessed`** for the same context to scope what they read or synced.
6. **Search across the tenant** for the attacker's IP addresses (`-IPAddresses`) and rule names, because attackers often reuse them.
7. **Export everything** to CSV and keep it with your incident notes, especially if retention is 180 days.

Audit records are typically available 60 to 90 minutes after an event, and Microsoft doesn't guarantee a time ([Microsoft Learn](https://learn.microsoft.com/en-us/purview/audit-search)). Re-run searches later before concluding that nothing happened.

If you have Defender for Office 365 Plan 2, [automated investigation and response](https://iblockspam.com/blog/microsoft-365-automated-investigation-response) also flags forwarding and delegation it finds, and [Threat Explorer](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections) can remove the phish that started it.

## Next steps

1. Today, confirm `UnifiedAuditLogIngestionEnabled` is `True` and `AuditDisabled` is `False`.
2. Check that `MailItemsAccessed` and `Send` are in `AuditOwner` for your key mailboxes, and set `AuditEnabled` on non-E5 mailboxes.
3. Give one or two named people the View-Only Audit Logs role before an incident.
4. Decide whether 180 days is enough, or export audit data somewhere you control.
5. Reduce how often you need this guide. Most mailbox compromises start with a phishing email; iBlockSpam filters phishing and spoofing at the MX. See [how it works](https://iblockspam.com/how-it-works).

Browse our other [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### How long does Microsoft 365 keep audit log records?

With Audit (Standard), 180 days for records created on or after October 17, 2023; older Standard records were kept for 90 days. With Audit (Premium), for example Microsoft 365 E5, Exchange, SharePoint, OneDrive and Entra ID records are kept for one year by default, and retention policies can extend that. Ten-year retention needs an extra add-on license.

### Is mailbox auditing turned on by default in Exchange Online?

Yes. Microsoft says mailbox audit logging is on by default in all organizations, and it has been since January 2019. Check it with Get-OrganizationConfig and the AuditDisabled property; False means auditing is on. Some mailbox events for users without E5 licenses may not show in searches until you set AuditEnabled on those mailboxes.

### What does MailItemsAccessed show in an investigation?

It records mail access by any protocol or client. Bind records list individual messages by Internet Message ID, aggregated over two-minute intervals. Sync records cover whole folders downloaded by desktop Outlook, and Microsoft says to assume every item in a synced folder is compromised. Compare IP address, client and session ID with the attacker's activity.

### How soon do events appear in the Microsoft 365 audit log?

Microsoft doesn't guarantee a time. For core services such as Exchange, SharePoint, OneDrive and Teams, records are typically available 60 to 90 minutes after the event, and other services can take longer. Don't conclude that nothing happened from a search run minutes after an incident.

### How do I find who set up forwarding on a mailbox in the audit log?

Search the audit log over the relevant dates without selecting an activity, then filter results to Set-Mailbox. Open each record and look at the Parameters field. ForwardingSmtpAddress shows the destination, DeliverToMailboxAndForward shows whether a copy stayed in the mailbox, and UserId shows who made the change.

## Sources

- [Microsoft Learn: Learn about auditing solutions in Microsoft Purview](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)
- [Microsoft Learn: Search the audit log](https://learn.microsoft.com/en-us/purview/audit-search)
- [Microsoft Learn: Manage mailbox auditing](https://learn.microsoft.com/en-us/purview/audit-mailboxes)
- [Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts](https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts)
- [Microsoft Learn: Search the audit log to investigate common support issues](https://learn.microsoft.com/en-us/purview/audit-troubleshooting-scenarios)
- [Microsoft Learn: Search-UnifiedAuditLog](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/search-unifiedauditlog)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/microsoft-365-audit-log-email-investigation (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt