Skip to content
Hermes Codex

Message Trace vs Mailbox Audit vs Unified Audit Log

When investigating email-based incidents—such as sophisticated Business Email Compromise (BEC), Adversary-in-the-Middle (AiTM) phishing, or mass data leakage—incident responders frequently encounter three distinct email-related telemetry sources: Exchange Message Trace, Mailbox Auditing, and the Microsoft Purview Unified Audit Log (UAL).

Each system answers fundamentally different forensic questions:

  • Message Trace answers: Did the email transit the network, and was it delivered?
  • Mailbox Auditing answers: What happened inside the user’s mailbox store, and was the email read or deleted?
  • The Unified Audit Log answers: Who performed these actions across the enterprise tenant, from what IP address, and in what holistic session context?

Failing to correlate these three systems produces flawed investigative conclusions. The most common error is declaring an email “opened” based solely on a Deliver status in Message Trace, or overlooking unauthorized inbox rule manipulation because the analyst searched only for message transmission events.

1. The Triangular Forensic Correlation Model

Section titled “1. The Triangular Forensic Correlation Model”

The definitive email forensic methodology in Microsoft 365 relies on the Triangular Correlation Model, linking transport, mailbox storage, and tenant compliance planes:

graph TD
    subgraph "1. Transport Layer (Exchange Message Trace)"
        MT_RECV[Receive Event<br/>OriginalClientIpAddress]
        MT_EOP[EOP Filtering & Authentication<br/>SPF / DKIM / DMARC]
        MT_DELIV[Store Driver Delivery<br/>Status: Deliver]
    end


    subgraph "2. Storage & Access Layer (Mailbox Auditing)"
        MA_ACCESS[MailItemsAccessed<br/>Bind vs Sync Action]
        MA_RULES[Inbox Rule Operations<br/>New-InboxRule / Move]
        MA_DELETE[Item Lifecycle<br/>SoftDelete / HardDelete]
    end


    subgraph "3. Enterprise Compliance Layer (Purview UAL)"
        UAL_SESSION[Session Correlation<br/>ClientIP, UserAgent, SessionId]
        UAL_IDENTITY[Identity Verification<br/>UserKey, AzureAD Token Binding]
        UAL_CROSS[Cross-Workload Correlation<br/>SharePoint Downloads, OAuth Consents]
    end


    MT_DELIV -->|Delivered Message| MA_ACCESS
    MA_ACCESS -->|Item-Level Events| UAL_SESSION
    MA_RULES -->|Rule Creation| UAL_SESSION
    MT_RECV -.->|NetworkMessageId Link| UAL_CROSS

2. Comparative Matrix: Telemetry Planes & Capabilities

Section titled “2. Comparative Matrix: Telemetry Planes & Capabilities”
Forensic DimensionExchange Message TraceMailbox AuditingPurview Unified Audit Log
System PlaneTransport & Mail Routing (MTA)Exchange Information Store (MDB)Centralized Compliance & Security
Primary Question”Did the email transit through EOP?""Did someone read, move, or delete the email?""What was the complete multi-workload attacker session?”
Unit of RecordSMTP Envelope / Message TransactionMailbox Item / Folder ActionPlatform Normalized JSON Record
Authoritative KeyNetworkMessageId / MessageIdInternetMessageId / FolderIdNetworkMessageId / Id / SessionId
Retention WindowStrictly 90 days (No extension)Inherited by UAL (180d to 1y+)Standard: 180 days
Premium: 1 year to 10 years
Ingestion LatencyReal-time (0 - 5 seconds)Internal store: immediateAsynchronous: 15 to 60 minutes
Content VisibilityEnvelopes only (Sender, Recipient, Subject)Message subjects, item IDs, foldersPolymorphic JSON (AuditData)
Access VerificationCannot prove accessProves read via MailItemsAccessedProves read + attributes Client IP & UA

3. The Classic Question: “Did the User Open the Phishing Email?”

Section titled “3. The Classic Question: “Did the User Open the Phishing Email?””

In corporate phishing investigations, legal counsel and leadership invariably ask: “Did the victim actually open the email and click the link?”

What Message Trace Actually Proves

Section titled “What Message Trace Actually Proves”

When Message Trace returns:

Status: Deliver
Detail: The message was successfully delivered to the folder: Inbox

This proves only that the Exchange Store Driver transferred the RFC 5322 payload across the transport boundary into the user’s Exchange database. It provides zero evidence that the user logged into Outlook, previewed the message, or clicked any hyperlinks.

What Mailbox Auditing & UAL Prove

Section titled “What Mailbox Auditing & UAL Prove”

To prove user engagement or attacker reconnaissance, the investigator must pivot to MailItemsAccessed (available under Purview Audit):

sequenceDiagram
    autonumber
    actor User as Corporate User / Threat Actor
    participant App as Outlook Web Access (OWA)
    participant Store as Exchange Mailbox Store
    participant UAL as Purview Unified Audit Log


    User->>App: Clicks email in Inbox (View Message)
    App->>Store: RPC/REST: GetItem(MessageId)
    Store->>Store: Evaluates Mailbox Audit Policy
    Store->>UAL: Emits "MailItemsAccessed" (MailAccessType: Bind)
    Note over UAL: Record contains InternetMessageId, ClientIP, UserAgent
    Note over UAL: Proves human/interactive inspection of message!
  • Bind Action: Proves that the individual message was explicitly opened or previewed in an interactive client (OWA, Outlook Desktop).
  • Sync Action: Proves that a client synchronized a batch of messages from the folder (e.g., mobile ActiveSync or an automated attacker exfiltration script).

4. End-to-End Correlation Scenario: BEC Infiltration & Exfiltration

Section titled “4. End-to-End Correlation Scenario: BEC Infiltration & Exfiltration”

Consider a realistic Business Email Compromise scenario where an attacker compromises executive credentials, receives an inbound invoice, alters banking details, and creates a hidden forwarding rule:

=================================================================================================
TIMELINE CORRELATION ACROSS THE THREE TELEMETRY SYSTEMS
=================================================================================================


1. [08:14:02 UTC] TRANSPORT LAYER (Message Trace):
   - Event: Receive -> Deliver
   - Sender: vendor_billing@supplier-corp.com
   - Recipient: cfo@defense-corp.org
   - Subject: "INVOICE #9812 - Revised Wire Instructions"
   - NetworkMessageId: 4d12f890-341a-4f89-91a1-987120adfe01
   - Status: Deliver (Dropped in Inbox)


2. [08:32:15 UTC] STORAGE & ACCESS LAYER (Mailbox Auditing / UAL RecordType 2):
   - Operation: MailItemsAccessed
   - MailAccessType: Bind
   - InternetMessageId: <VENDOR-INV-9812@supplier-corp.com>
   - MailboxOwnerUPN: cfo@defense-corp.org
   - PROOF: The attacker explicitly opened and inspected the invoice!


3. [08:35:40 UTC] COMPLIANCE LAYER (Purview UAL RecordType 1):
   - Operation: New-InboxRule
   - UserId: cfo@defense-corp.org
   - ClientIP: 185.220.101.42 (Tor Exit Node)
   - Parameters: Name="...", MoveToFolder="RSS Subscriptions", DeleteMessage="True"
   - PROOF: Attacker deployed a persistence rule to conceal future billing conversations!


4. [08:42:10 UTC] TRANSPORT LAYER (Message Trace):
   - Event: Submit -> Send
   - Sender: cfo@defense-corp.org
   - Recipient: accounts-payable@defense-corp.org
   - Subject: "URGENT: Approved Vendor Invoice #9812 - Updated IBAN"
   - NetworkMessageId: e12a4b89-1234-4567-890a-bcdef0123456
   - PROOF: Fraudulent outbound email dispatched from the executive's legitimate mailbox!
=================================================================================================

5. Practical Multi-Source Extraction Scripts

Section titled “5. Practical Multi-Source Extraction Scripts”
Terminal window
Connect-ExchangeOnline -UserPrincipalName dfir@defense-corp.org


$targetUser = "cfo@defense-corp.org"
$startTime = (Get-Date).AddDays(-2).ToUniversalTime()
$endTime   = (Get-Date).ToUniversalTime()


# 1. Transport Layer: All inbound deliveries to the target
Write-Host "[-] Phase 1: Querying Transport Message Trace..." -ForegroundColor Cyan
$deliveredEmails = Get-MessageTrace -RecipientAddress $targetUser -StartDate $startTime -EndDate $endTime -Status Deliver


# 2. Mailbox Storage Layer: MailItemsAccessed events for the user
Write-Host "[-] Phase 2: Querying Mailbox Audit Access Logs..." -ForegroundColor Cyan
$mailboxReads = Search-UnifiedAuditLog `
    -StartDate $startTime `
    -EndDate $endTime `
    -RecordType ExchangeItem `
    -Operations "MailItemsAccessed" `
    -FreeText $targetUser `
    -ResultSize 5000 `
    -Formatted


# 3. Correlating Message Trace delivery with actual mailbox reads
$readMessageIds = foreach ($record in $mailboxReads) {
    $audit = $record.AuditData | ConvertFrom-Json
    if ($audit.Folder.FolderItems) {
        $audit.Folder.FolderItems.InternetMessageId
    }
}


$correlationResults = foreach ($email in $deliveredEmails) {
    $wasRead = if ($readMessageIds -contains $email.MessageId) { $true } else { $false }
    [PSCustomObject]@{
        ReceivedTime     = $email.Received
        NetworkMessageId = $email.NetworkMessageId
        Sender           = $email.SenderAddress
        Subject          = $email.Subject
        Delivered        = $true
        VerifiedRead     = $wasRead
    }
}


$correlationResults | Format-Table -AutoSize

6. Investigative Traps & Correlation Pitfalls

Section titled “6. Investigative Traps & Correlation Pitfalls”

7. Cross-Reference & Operational Mesh

Section titled “7. Cross-Reference & Operational Mesh”