Office 365: Bulk enabling auditing on Exchange Online Mailboxes
Auditing of mailbox operations are not enabled by default in Exchange Online. It is the responsibility of the administrator to choose which mailboxes should have auditing enabled and then subsequently enable auditing on the mailboxes. We have documented the process of enabling auditing on mailboxes in bulk at the following link:
I recently had a customer inquire if there were alternatives to having the client process the majority of this work. It is possible to invoke commands and allow for service processing – the issue is that the commands must be basic. For example, you cannot craft an invocation command that would attempt to filter users <or> implement a sleep during each set as the invocation syntax would be too large and complex. For example…
PS C:\> Invoke-Command -Session (Get-PSSession) -ScriptBlock {Get-Mailbox -ResultSize unlimited -RecipientTypeDetails UserMailbox | where{$_.auditingEnabled -ne $FALSE} | Set-Mailbox -AuditEnabled:$TRUE -Verbose}
The syntax is not supported by this runspace. This can occur if the runspace is in no-language mode.
+ CategoryInfo : ParserError: (Get-Mailbox -Re...:$TRUE -Verbose:String) [], ParseException
+ FullyQualifiedErrorId : ScriptsNotAllowed
+ PSComputerName : ps.outlook.com
PS C:\> Invoke-Command -Session (Get-PSSession) -ScriptBlock {Get-Mailbox -ResultSize unlimited -RecipientTypeDetails UserMailbox | Set-Mailbox -AuditEnabled:$TRUE -Verbose;Start-Sleep -Milliseconds 500}
The syntax is not supported by this runspace. This can occur if the runspace is in no-language mode.
+ CategoryInfo : ParserError: (Get-Mailbox -Re...illiseconds 500:String) [], ParseException
+ FullyQualifiedErrorId : ScriptsNotAllowed
+ PSComputerName : ps.outlook.com
Depending on the tenants size the following command may work – shifting the processing logic from the client to the service.
Invoke-Command -Session (Get-PSSession) -ScriptBlock {Get-Mailbox -ResultSize unlimited -RecipientTypeDetails UserMailbox | Set-Mailbox -AuditEnabled:$TRUE -Verbose}
If any throttling is encountered you may have to refer to the commands as outlined within the support article.
*Thanks to Matt Byrd for reviewing and commenting on these methods.