Exchange Online - Identify mailboxes with audit disabled

 

One of the Microsoft Secure Score recommendations is to ensure mailbox auditing for all users is enabled.
Although within the recommendation implementation there's a powershell command to do it organization wide, there's always the need to do it individually for resource mailboxes for example.

So, to enable auditing organization wide command is this one:

Set-OrganizationConfig -AuditDisabled $false

view raw EXOSetAuditEnabledOrganizationWide.ps1 hosted with ❤ by GitHub

Now, to identify which mailboxes still aren't enabled, just run this command:

Get-Mailbox -ResultSize unlimited | where {$_.auditenabled -eq $False} | select userprincipalname, auditenabled

view raw gistfile1.txt hosted with ❤ by GitHub

Finally, to enable auditing in that mailboxes, run this command for each one:

Set-Mailbox -Identity "userprincipalname" -AuditEnabled $true

view raw gistfile1.txt hosted with ❤ by GitHub

And you're done! :)