Mailbox Auditing & MailItemsAccessed Deep Dive

In email compromise investigations, discovering that an adversary authenticated into an executive or employee mailbox is only the initial finding. Legal counsel, compliance officers, and regulatory bodies (such as GDPR, HIPAA, or SEC disclosure frameworks) immediately pose the decisive question: “Did the attacker actually access or exfiltrate sensitive emails, or did they merely authenticate?”

Answering this question requires Exchange Online Mailbox Auditing. Mailbox audit logs record actions performed within mailboxes by owners, delegates, and tenant administrators. Among these operations, MailItemsAccessed (RecordType 50) is the single most critical forensic event: it provides verifiable evidence of read access to individual email messages and bulk synchronization of mailbox folders.

This guide provides an exhaustive architectural and forensic dissection of Mailbox Auditing, focusing on logon types, event collection configurations, MailItemsAccessed internal mechanics (Bind vs Sync), deduplication throttles, message ID reconstruction, and anti-forensics defense.

---

1. Mailbox Auditing Architecture & Configuration

1.1 Default Mailbox Auditing History & State

Historically (prior to January 2019), Exchange Online mailbox auditing was disabled by default (AuditEnabled = false), forcing incident response teams to grapple with forensic blindness unless the organization had explicitly enabled it across every mailbox.

Since 2019, Microsoft has enabled Mailbox Auditing by default across all Exchange Online tenants. However, an investigator must verify two critical configurations during initial triage:

1. Tenant-Level Default Setting: Controlled via Set-OrganizationConfig -AuditDisabled $false.
2. Mailbox-Level Configuration: Controlled via Set-Mailbox -AuditEnabled $true and the audited action arrays.

graph TD
    subgraph "Exchange Online Mailbox Store"
        MBX[Mailbox Object: victim@target.com]
        PROP[Audit Properties: AuditEnabled / AuditLogAgeLimit]
    end

    subgraph "Logon Contexts"
        OWNER[Owner: Direct Mailbox Principal]
        DELEGATE[Delegate: Shared MBX / Send-As / FullAccess]
        ADMIN[Admin: eDiscovery / Compliance / Tenant Admin]
    end

    subgraph "Audit Pipeline"
        AUDIT_ENGINE[Exchange Mailbox Auditing Engine]
        RECOVERABLE[Recoverable Items / Audits Folder]
        PURVIEW_BUS[Office 365 Management Activity API / UAL Ingestion]
    end

    OWNER -->|Operations: MailItemsAccessed, SoftDelete...| AUDIT_ENGINE
    DELEGATE -->|Operations: SendAs, Create, Move...| AUDIT_ENGINE
    ADMIN -->|Operations: SearchQueryInitiatedExchange...| AUDIT_ENGINE

    MBX --- PROP
    AUDIT_ENGINE --> RECOVERABLE
    RECOVERABLE --> PURVIEW_BUS

1.2 Logon Types & Action Sets

Exchange Online categorizes all mailbox activity into three distinct Logon Types:

Logon Type	Definition	Default Audited Actions (E5 / Audit Premium)	Forensics Significance
Owner	The primary licensed identity assigned to the mailbox.	MailItemsAccessed, Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, Create	Critical for BEC where the attacker compromises the user’s primary credentials (passwords, session cookies).
Delegate	Another user or service principal accessing the mailbox via permissions (FullAccess, SendAs, SendOnBehalf).	MailItemsAccessed, SendAs, SendOnBehalf, Create, Update, Move, MoveToDeletedItems, SoftDelete, HardDelete	Essential for analyzing lateral movement via shared mailboxes, executive assistant delegates, or compromised service accounts.
Admin	Administrative actions performed by Exchange Admins, Compliance Officers, or automated tenant management tools.	SearchQueryInitiatedExchange, Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, SendAs	Crucial for identifying insider threats, rogue admins, or compromised Global Admin accounts exfiltrating data via compliance tooling.

The Default Audit Set Trap

By default, Exchange Online applies a managed set of audited actions (DefaultAuditSet). If an administrator manually overrides audited actions using Set-Mailbox -AuditOwner @(...), Exchange freezes that mailbox’s audit configuration and stops automatically adding newly introduced Microsoft audit events.

Verify if a mailbox is using the Microsoft-managed default or a custom configuration using:

Get-Mailbox victim@target.com | Select-Object -Property Identity, AuditEnabled, DefaultAuditSet, AuditOwner, AuditDelegate, AuditAdmin | Format-List

1.3 Audit Pipeline Verification & Hardening Script

During incident response, immediately verify and ensure comprehensive auditing across targeted accounts using the following PowerShell commands:

# Check tenant-wide mailbox auditing status
Get-OrganizationConfig | Select-Object -Property AuditDisabled

# Verify targeted mailbox configuration
Get-Mailbox -Identity "victim@target.com" | Format-List AuditEnabled, AuditLogAgeLimit, AuditOwner, AuditDelegate, AuditAdmin

# Ensure full forensic logging on high-risk mailboxes (C-Suite, Finance, HR)
Set-Mailbox -Identity "victim@target.com" `
    -AuditEnabled $true `
    -AuditLogAgeLimit 365.00:00:00 `
    -AuditOwner @{Add="MailItemsAccessed","Update","Move","MoveToDeletedItems","SoftDelete","HardDelete","Create"} `
    -AuditDelegate @{Add="MailItemsAccessed","SendAs","SendOnBehalf","Create","Update","Move","MoveToDeletedItems","SoftDelete","HardDelete"} `
    -AuditAdmin @{Add="MailItemsAccessed","Update","Move","MoveToDeletedItems","SoftDelete","HardDelete","SendAs","SendOnBehalf"}

---

2. MailItemsAccessed Deep Dive

Before MailItemsAccessed was introduced, digital investigators relied on noisy actions like Update (e.g., when a user marked an unread email as read). However, if an adversary viewed an email that was already marked as read, opened an item in preview mode, or synchronized the mailbox via ActiveSync or IMAP, no audit log was generated. Attackers operated with forensic invisibility regarding data exfiltration.

MailItemsAccessed (RecordType 50) resolves this limitation by recording access to email messages regardless of whether the message state changed.

graph TD
    ATTACKER[Adversary Authenticated to Mailbox] --> METHOD{Access Vector}

    METHOD -->|Web / Desktop Client / Graph API| BIND[Bind Operation<br/>Single Item Interaction]
    METHOD -->|IMAP / POP3 / ActiveSync / Cached Sync| SYNC[Sync Operation<br/>Bulk Folder Synchronization]

    BIND --> BIND_PAYLOAD[Audit Payload contains:<br/>- Subject<br/>- InternetMessageId<br/>- FolderId<br/>- ItemHexId]
    SYNC --> SYNC_PAYLOAD[Audit Payload contains:<br/>- FolderId<br/>- FolderItems Array: ItemIds<br/>- Truncated if threshold exceeded]

    BIND_PAYLOAD --> EXFIL_PROOF[Direct Exfiltration Evidence:<br/>Targeted Read Confirmed]
    SYNC_PAYLOAD --> BULK_PROOF[Bulk Exfiltration Evidence:<br/>Folder-Wide Compromise]

2.1 The Bind Operation

A Bind operation represents an individual, interactive access to a single email message.

Triggering Mechanisms

• A user double-clicks an email in Outlook Web App (OWA) or Outlook Desktop to open it in a dedicated window.
• An email is selected and displayed in the Reading/Preview Pane for more than a few seconds.
• An application or script reads a specific message using the Microsoft Graph API (GET /v1.0/users/{id}/messages/{message-id}) or Exchange Web Services (EWS GetItem).

Forensic Artifact Payload: Bind

When extracted from the Unified Audit Log (UAL), the AuditData JSON contains the following structure:

{
  "CreationTime": "2026-03-20T14:22:15",
  "Id": "a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d",
  "Operation": "MailItemsAccessed",
  "OrganizationId": "8f3b6a9c-2d1e-4b5a-9f8e-7c6b5a4d3e2f",
  "RecordType": 50,
  "ResultStatus": "Succeeded",
  "UserKey": "victim@target.com",
  "UserType": 0,
  "Version": 1,
  "Workload": "Exchange",
  "ClientIP": "198.51.100.45",
  "UserId": "victim@target.com",
  "MailboxOwnerUPN": "victim@target.com",
  "MailboxOwnerSid": "S-1-5-21-1234567890-123456789-123456789-1001",
  "LogonType": 0,
  "InternalLogonType": 0,
  "MailboxGuid": "4a5b6c7d-8e9f-0a1b-2c3d-4e5f6a7b8c9d",
  "MailboxResolvedOwnerName": "Alice Dupont",
  "OperationProperties": [
    {
      "Name": "MailAccessType",
      "Value": "Bind"
    },
    {
      "Name": "IsThrottled",
      "Value": "False"
    }
  ],
  "AppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c",
  "ClientAppName": "OWA",
  "ClientInfoString": "Client=OWA;Action=ViaProxy",
  "Folders": [
    {
      "FolderId": "LgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAAAAEKAAAB",
      "FolderItems": [
        {
          "InternetMessageId": "<SJ0PR03MB74129A8F7C6B5@SJ0PR03MB7412.eurprd03.prod.outlook.com>",
          "ItemId": "RgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAKAAAB",
          "Subject": "CONFIDENTIAL: Q1 Financial Audit and Banking Details"
        }
      ],
      "Path": "\Inbox"
    }
  ]
}

Key investigation fields in a Bind event:

• OperationProperties[MailAccessType]: Set explicitly to Bind.
• Folders[].Path: The folder containing the opened item (e.g., \Inbox, \Sent Items).
• Folders[].FolderItems[].Subject: The exact subject line of the email opened by the adversary.
• Folders[].FolderItems[].InternetMessageId: The immutable RFC 5322 identifier, allowing direct pivoting to Fiche 15: Exchange Online Message Trace and Fiche 16: Trace vs Mailbox vs UAL.
• ClientInfoString & ClientIP: Identifies the client architecture and egress IP used by the threat actor.

---

2.2 The Sync Operation

A Sync operation occurs when a protocol or client synchronizes a folder containing multiple messages, caching or downloading items in bulk.

Triggering Mechanisms

• Initial profile configuration of Outlook desktop (caching mailbox contents locally to .ost).
• Synchronizing mailboxes to mobile devices via Exchange ActiveSync (EAS).
• Legacy protocols: POP3 (RETR loop) or IMAP4 (FETCH commands).
• Adversary tooling querying the Microsoft Graph API with batch requests (GET /v1.0/users/{id}/mailFolders/inbox/messages?$top=50) or delta tokens.

Forensic Artifact Payload: Sync

In a Sync event, Exchange records the accessed folder and an array of accessed ItemId identifiers:

{
  "CreationTime": "2026-03-20T15:10:04",
  "Id": "f9e8d7c6-b5a4-3210-9876-543210abcdef",
  "Operation": "MailItemsAccessed",
  "OperationProperties": [
    {
      "Name": "MailAccessType",
      "Value": "Sync"
    },
    {
      "Name": "IsThrottled",
      "Value": "False"
    }
  ],
  "ClientAppName": "ActiveSync",
  "ClientInfoString": "Client=REST;Client=AppleMail;Version=17.4",
  "ClientIP": "203.0.113.88",
  "Folders": [
    {
      "FolderId": "LgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAAAAEKAAAB",
      "FolderItems": [
        { "ItemId": "RgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAKAAAC" },
        { "ItemId": "RgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAKAAAD" },
        { "ItemId": "RgAAAAB2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8g9h0i1j2k3l4AAAKAAAE" }
      ],
      "Path": "\Inbox"
    }
  ]
}

Missing Subject in Sync Records

Unlike Bind events, Sync audit records frequently do not include the Subject or InternetMessageId directly in the FolderItems array. Instead, they provide Exchange Store item IDs (ItemId). Forensic investigators must resolve these ItemId identifiers using the Exchange Web Services (EWS) or Microsoft Graph API to reconstruct the list of exfiltrated messages (see Section 4).

---

3. Throttling, Aggregation & Deduplication Mechanics

Mailbox auditing generates immense log volume. To avoid overwhelming the Purview ingestion pipeline, Microsoft applies strict throttling and deduplication rules to MailItemsAccessed.

3.1 The 24-Hour Deduplication Window

If the same client session reads the same email message multiple times within a 24-hour period, Exchange Online records only the first access event:

[Day 1, 09:00 UTC] Attacker opens Email #1234 -> Logged in UAL (MailItemsAccessed: Bind)
[Day 1, 09:15 UTC] Attacker re-opens Email #1234 -> Suppressed (Deduplicated)
[Day 1, 14:00 UTC] Attacker forwards Email #1234 -> SendAs logged, but Bind suppressed
[Day 2, 09:01 UTC] Attacker opens Email #1234 -> Logged in UAL (New 24h window)

Forensic implication:

• The absence of subsequent MailItemsAccessed events does not prove an attacker did not consult an email again within that 24-hour window.
• The recorded timestamp represents the earliest observed access during that session interval.

3.2 Sync Throttling (IsThrottled = True)

When a client synchronizes a folder with massive numbers of items (typically more than 1,000 items in quick succession) or executes repeated high-volume sync loops, Exchange Online triggers throttling:

1. The initial batch of item IDs is recorded in the FolderItems array.
2. If the volume exceeds the buffer threshold, subsequent records set:

   "OperationProperties": [
     { "Name": "MailAccessType", "Value": "Sync" },
     { "Name": "IsThrottled", "Value": "True" }
   ]

3. When IsThrottled is True, the FolderItems array may be completely omitted or truncated.

Forensic Presumption Under IsThrottled = True

From a regulatory and data breach assessment standpoint, if an adversary connects from an unauthorized IP and triggers a Sync operation where IsThrottled = True on an executive’s \Inbox or \Sent Items folder, forensic analysts must presume that every single email residing in that folder at the time of synchronization was accessed and potentially exfiltrated.

---

4. Decompressing FolderItems and Resolving Exchange Item IDs

When a Sync event logs an array of raw ItemId strings without subject lines, responders must map those IDs back to message metadata.

4.1 Resolving Store Item IDs via Microsoft Graph PowerShell

Because Exchange Online Store IDs (RgAAAAB...) are Base64-encoded PR_ENTRYID structures, they can be translated into Graph IDs or queried directly using Exchange Web Services or Graph API:

# Prerequisites: Microsoft.Graph module connected with Mail.Read permissions
# Connect-MgGraph -Scopes "Mail.Read"

# Extracting Item IDs from an exported UAL JSON record
$ualJson = Get-Content -Path "C:\DFIR\MailItemsAccessed_Sync_Record.json" | ConvertFrom-Json
$auditData = $ualJson.AuditData | ConvertFrom-Json

$compromisedUser = $auditData.MailboxOwnerUPN
$folderPath = $auditData.Folders[0].Path

Write-Host "[*] Analyzing Sync event for: $compromisedUser in folder: $folderPath" -ForegroundColor Cyan

# Loop through each ItemId in the FolderItems array
$accessedItems = @()
foreach ($item in $auditData.Folders[0].FolderItems) {
    $storeId = $item.ItemId

    # Translate EWS/Store ItemId to Graph ID using TranslateExchangeIds API
    $idTranslationBody = @{
        inputIds = @($storeId)
        sourceIdType = "ewsId"
        targetIdType = "restId"
    }

    try {
        $translatedId = (Invoke-MgGraphRequest -Method POST `
            -Uri "https://graph.microsoft.com/v1.0/me/translateExchangeIds" `
            -Body ($idTranslationBody | ConvertTo-Json)).value[0].targetId

        # Fetch message metadata via Graph
        $msg = Get-MgUserMessage -UserId $compromisedUser -MessageId $translatedId `
            -Property "Subject,Sender,ReceivedDateTime,HasAttachments,InternetMessageId"

        $accessedItems += [PSCustomObject]@{
            StoreItemId       = $storeId
            InternetMessageId = $msg.InternetMessageId
            Subject           = $msg.Subject
            Sender            = $msg.Sender.EmailAddress.Address
            ReceivedTime      = $msg.ReceivedDateTime
        }
    }
    catch {
        Write-Warning "Failed to resolve item ID: $storeId (Item may have been permanently deleted by attacker)"
    }
}

# Export resolved forensic catalog
$accessedItems | Export-Csv -Path "C:\DFIR\Resolved_Exfiltrated_Emails.csv" -NoTypeInformation
Write-Host "[+] Reconstructed $($accessedItems.Count) exfiltrated email records." -ForegroundColor Green

---

5. Critical Mailbox Operations Beyond MailItemsAccessed

While MailItemsAccessed reveals reading activity, adversaries perform numerous other mailbox manipulations to achieve persistence, defense evasion, and financial fraud:

Operation	Typical Threat Actor Technique	MITRE ATT&CK
SendAs	Adversary dispatches an email impersonating the mailbox owner directly (e.g., fraudulent wire transfer instructions to payroll/vendor).	T1564.008
SendOnBehalf	Adversary sends mail using delegated permissions; recipient sees “Attacker on behalf of Victim”.	T1098
Create	Staging drafts containing phishing lures or preparing outgoing BEC messages. Also triggered when attackers import mail.	T1114.002
Move	Moving incriminating emails, security alerts, or vendor replies into hidden subfolders (e.g., \RSS Subscriptions or \Archive).	T1564.008
MoveToDeletedItems	Interactively deleting incoming communications from victims or security teams.	T1070.008
SoftDelete	Deleting an item such that it moves into the Recoverable Items\Deletions folder (recoverable by user).	T1070.008
HardDelete	Purging an item from Recoverable Items\Purges folder (anti-forensics attempt to bypass user recovery).	T1070.008
UpdateFolderPermissions	Granting an external identity or another compromised account delegate access to the mailbox.	T1098

---

6. Forensic Hunting & KQL Workflows

To investigate mailbox compromise at scale across Microsoft Sentinel, Microsoft Defender XDR (CloudAppEvents), or Log Analytics, utilize the following production-tested KQL queries.

6.1 Detecting High-Volume or Anomalous MailItemsAccessed by IP

Identify instances where a non-corporate or unfamiliar IP accessed executive mailboxes:

CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "MailItemsAccessed"
| extend RawData = parse_json(RawEventData)
| extend MailAccessType = tostring(RawData.OperationProperties[0].Value),
         IsThrottled = tostring(RawData.OperationProperties[1].Value),
         ClientIP = tostring(RawData.ClientIP),
         ClientAppName = tostring(RawData.ClientAppName),
         LogonType = tostring(RawData.LogonType),
         Folders = RawData.Folders
| mv-expand Folders
| extend FolderPath = tostring(Folders.Path),
         FolderItemsCount = array_length(Folders.FolderItems)
| summarize
    AccessCount = count(),
    TotalItemsAccessed = sum(FolderItemsCount),
    AccessedFolders = make_set(FolderPath),
    ClientApps = make_set(ClientAppName)
    by AccountDisplayName, ClientIP, IPAddress, MailAccessType, IsThrottled, bin(TimeGenerated, 1h)
| sort by TotalItemsAccessed desc

6.2 Correlating Entra Sign-In with Mailbox Destruction (HardDelete)

Correlate an unfamiliar Entra ID sign-in session with subsequent anti-forensic deletion activity in Exchange Online:

let CompromisedUsers = SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == 0
| where NetworkLocationDetails has "Unknown" or RiskLevelDuringSignIn in ("high", "medium")
| distinct UserPrincipalName, IPAddress;
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType in ("HardDelete", "SoftDelete", "MoveToDeletedItems")
| extend RawData = parse_json(RawEventData)
| extend ClientIP = tostring(RawData.ClientIP)
| join kind=inner (CompromisedUsers) on $left.AccountDisplayName == $right.UserPrincipalName, $left.ClientIP == $right.IPAddress
| project TimeGenerated, AccountDisplayName, ActionType, ClientIP, CountryCode, ObjectName, RawData
| sort by TimeGenerated desc

---

7. Data Breach Assessment Decision Tree

When compiling the incident report for compliance authorities, follow this rigorous forensic decision matrix:

graph TD
    A[Suspicious Sign-In Detected] --> B{Did MailItemsAccessed Log Events?}

    B -->|No - No Events Logged| C{Was Audit Enabled & Retained?}
    C -->|Yes| D[Finding: Access Proven, Exfiltration Not Evident<br/>No item access detected during session window]
    C -->|No / Audit Blindness| E[Finding: Indeterminate Data Access<br/>Audit log absent; potential breach cannot be disproven]

    B -->|Yes - Events Logged| F{MailAccessType?}

    F -->|Bind Only| G[Finding: Targeted Exfiltration Confirmed<br/>Specific emails listed in FolderItems were accessed]
    F -->|Sync| H{IsThrottled == True?}

    H -->|False| I[Finding: Scoped Bulk Access Confirmed<br/>Items listed in FolderItems were downloaded/synced]
    H -->|True| J[Finding: Complete Folder Compromise Presumed<br/>Entire folder contents presumed exfiltrated under GDPR/HIPAA]

Summary Assessment Table for Legal Counsel

Scenario Observed	Forensic Finding	Breach Notification Burden
Sign-in successful; 0 MailItemsAccessed events recorded within 24h of activity; Mailbox Auditing active.	No Email Read Access. Adversary session did not touch email bodies (likely intercepted at MFA prompt or abandoned before mailbox load).	Minimal risk; typically does not trigger GDPR/HIPAA breach notification.
Single Bind event recorded with specific InternetMessageId.	Confirmed Specific Read. Only the identified email and its attachments were exposed to the adversary.	Limited breach notice; scoped strictly to data subjects referenced in that specific email.
Sync event with IsThrottled = False listing 42 ItemId entries in \Inbox.	Scoped Bulk Compromise. 42 distinct emails were downloaded by adversary tooling.	Notice scoped specifically to the recipients and senders of those 42 messages.
Sync event with IsThrottled = True in \Inbox (12,000 total items in folder).	Full Folder Compromise Presumed. Forensic limits prevent identifying which specific items were excluded.	High risk; regulators require assuming the full folder volume (12,000 items) was compromised.
Mailbox auditing disabled (AuditEnabled = False).	Forensic Blindness / Indeterminate. Attacker authenticated with full access; impossible to verify what was accessed.	Maximum risk; legal counsel must often treat as a worst-case potential data compromise.

---

8. Cross-Reference & Investigation Navigation

• Previous Fiche: 16. Message Trace vs Mailbox Audit vs Unified Audit Log
• Next Fiche: 18. Microsoft 365 Audit Retention & Licensing Realities
• Related Guides:
  • 05. Global Reader & Access Matrix
  • 07. Evidence Preservation & Tenant Freezing
  • 13. Microsoft Purview Unified Audit Log (UAL)
  • 15. Exchange Online Message Trace Forensics
  • 19. Account Compromise Kill Chain
  • 28. Mailbox Delegation & Permissions Abuse
  • 29. Malicious Inbox Rules & Forwarding\n