When your organization faces a business-email compromise (BEC) incident, one of the hardest questions is: “What did the attacker actually read or export?” Conventional logs often show only sign-ins or outbound sends, but not the depth of mailbox item access. The MailItemsAccessed audit event in Microsoft 365 Unified Audit Log (UAL) brings far more visibility — if configured correctly. This article outlines a repeatable, defensible process for investigation using that event, from readiness verification to scoping and reporting.

---

Objective

Provide a repeatable, defensible process to identify, scope, and validate email exposure in BEC investigations using the MailItemsAccessed audit event.

---

Phase 1 — Readiness Verification (Pre-Incident)

Before an incident hits, you must validate your logging and audit posture. These steps ensure you’ll have usable data.

1. Confirm Licensing

• Verify your tenant’s audit plan under Microsoft Purview Audit (Standard or Premium).

  • Audit (Standard): default retention 180 days (previously 90).

  • Audit (Premium): longer retention (e.g., 365 days or more), enriched logs.

• Confirm that your license level supports the MailItemsAccessed event. Many sources state this requires Audit Premium or an E5-level compliance add-on.

2. Validate Coverage

• Confirm mailbox auditing is on by default for user mailboxes. Microsoft states this for Exchange Online.

• Confirm that MailItemsAccessed is part of the default audit set (or if custom audit sets exist, that it’s included). According to Microsoft documentation: the MailItemsAccessed action “covers all mail protocols … and is enabled by default for users assigned an Office 365 E3/E5 or Microsoft 365 E3/E5 licence.”

• For tenants with customised audit sets, ensure the Microsoft defaults are re-applied so that MailItemsAccessedisn’t inadvertently removed.

3. Retention & Baseline

• Record what your current audit-log retention policy is (e.g., 180 days vs 365 days) so you know how far back you can search.

• Establish a baseline volume of MailItemsAccessed events—how many are generated from normal activity. That helps define thresholds for abnormal behaviour during investigation.

---

Phase 2 — Investigation Workflow (During Incident)

Once an incident is underway and you have suspected mailboxes, follow structured investigation steps.

1. Identify Affected Accounts

From your alarm sources (e.g., anomalous sign-in alerts, inbound or outbound rule creation, unusual inbox rules, compromised credentials) compile a list of mailboxes that might have been accessed.

2. Extract Evidence

In the Purview portal → Audit → filter for Activity = MailItemsAccessed, specifying the time range that covers suspected attacker dwell time.
Export the results to CSV via the Unified Audit Log.

3. Correlate Access Sessions

Group the MailItemsAccessed results by key session indicators:

• ClientIP

• SessionId

• UserAgent / ClientInfoString

Flag sessions that show:

• Unknown or non-corporate IP addresses (e.g., external ASN)

• Legacy protocols (IMAP, POP, ActiveSync) or bulk-sync behaviour

• User agents indicating automated tooling or scripting

4. Quantify Exposure

• Count distinct ItemIds and FolderPaths to determine how many items and which folders were accessed.

• Look for throttling indicators (for example more than ~1,000 MailItemsAccessed events in 24 h for a single user may indicate scripted or bulk access).

• Use the example KQL queries below (see Section “KQL Example Snippets”).

5. Cross-Correlate with Other Events

• Overlay these results with Send audit events and InboxRule/New-InboxRule events to detect lateral-phish, rule-based fraud or data-staging behaviour.

• For example, access events followed by mass sends indicate attacker may have read and then exfiltrated or used the account for fraud.

6. Validate Exfil Path

• Check the client protocol used by the session. If the client is REST API, bulk sync or legacy protocol, that may indicate the attacker is exfiltrating rather than simply reading.

• If MailItemsAccessed shows items accessed using a legacy IMAP/POP or ActiveSync session — that is a red flag for mass download.

---

Phase 3 — Analysis & Scoping

Once raw data is collected, move into analysis to scope the incident.

1. Establish Attack Session Timeline

• Combine sign-in logs (from Microsoft Entra ID Sign‑in Logs) with MailItemsAccessed events to reconstruct dwell time and sequence.

• Determine when attacker first gained access, how long they stayed, and when they left.

2. Define Affected Items

• Deliver an itemised summary (folder path, count of items, timestamps) of mailbox items accessed.

• Limit exposure claims to the items you have logged evidence for — do not assume access of the entire mailbox unless logs show it (or you have other forensic evidence).

3. Corroborate with Throttling and Send Events

• If you see unusual high-volume access plus spike in Send events or inbox rule changes, you can conclude automated or bulk access occurred.

• Document IOCs (client IPs, session IDs, user-agent strings) tied to the malicious session.

---

Phase 4 — Reporting & Validation

After investigation you report findings and validate control-gaps.

1. Evidence Summary

Your report should document:

• Tenant license type and retention (Audit Standard vs Premium)

• Audit coverage verification (mailbox auditing enabled, MailItemsAccessed present)

• Affected item count, folder paths, session data (IPs, protocol, timeframe)

• Indicators of compromise (IOCs) and signs of mass or scripted access

2. Limitations

Be transparent about limitations:

• Upgrading to Audit Premium mid-incident will not backfill missing MailItemsAccessed data for the earlier period. Sources note this gap.

• If mailbox auditing or default audit-sets were customised (and MailItemsAccessed omitted), you may lack full visibility. Example commentary notes this risk.

3. Recommendations

• Maintain Audit Premium licensing for at-risk tenants (e.g., high-value executive mailboxes or those handling sensitive data).

• Pre-stage KQL dashboards to detect anomalies (e.g., bursts of MailItemsAccessed, high counts per hour or per day) so you don’t rely solely on ad-hoc searches.

• Include audit-configuration verification (licensing, mail-audit audit-set, retention) in your regular vCISO or governance audit cadence.

---

KQL Example Snippets

---

MITRE ATT&CK Mapping

These mappings illustrate how MailItemsAccessed visibility ties directly into attacker-behaviour frameworks in cloud email contexts.

---

Minimal Control Checklist

•  Verify Purview Audit plan and retention

•  Validate MailItemsAccessed events present/searchable for a sample of users

•  Ensure mailbox auditing defaults (default audit-set) restored and active

•  Pre-stage anomaly detection queries / dashboards for mailbox-access bursts

---

Conclusion

When investigating a BEC incident, possession of high-fidelity audit data like MailItemsAccessed transforms your investigation from guesswork into evidence-driven clarity. The key is readiness: licence appropriately, validate your coverage, establish baselines, and when a breach occurs follow a structured workflow from extraction to scoping to reporting. Without that groundwork your post-incident forensics may hit blind spots. But with it you increase your odds of confidently quantifying exposure, attributing access and closing the loop.

Prepare, detect, dissect—repeatably.

---

References

1. Microsoft Learn: Manage mailbox auditing – “Mailbox audit logging is turned on by default in all organizations.”

2. Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts – “The MailItemsAccessed action … is enabled by default for users that are assigned an Office 365 E3/E5 or Microsoft 365 E3/E5 license.”

3. Microsoft Learn: Auditing solutions in Microsoft Purview – licensing and search prerequisites.

4. Office365ITPros: Enable MailItemsAccessed event for Exchange Online – “Purview Audit Premium is included in Office 365 E5 and … Audit (Standard) is available to E3 customers.”

5. TrustedSec blog: MailItemsAccessed woes – “According to Microsoft, this event is only accessible if you have the Microsoft Purview Audit (Premium) functionality.”

6. Practical365: Microsoft’s slow delivery of MailItemsAccessed audit event – retention commentary.

7. O365Info: Manage audit log retention policies – up to 10 years for Premium.

8. Office365ITPros: Mailbox audit event ingestion issues for E3 users.

9. RedCanary blog: Entra ID service principals and BEC – “MailItemsAccessed is a very high volume record …”

 

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.