Definition
Exchange mailbox auditing records supported mailbox operations, subject to platform settings and licensing.
How it works
Events can cover owners, delegates and administrators, but available actions, retention and search capabilities depend on the environment.
Real-world example
After suspected unauthorized mailbox access, audit events may help reconstruct message or folder actions when correlated with Entra sign-in records.
Limits and best practices
Verify audit status, licensing, retention and search coverage. The absence of an event is not proof that no activity occurred.