Is mailbox auditing on, and which accounts bypass it?

#Requires -Modules ExchangeOnlineManagement
# Organisation-wide mailbox auditing switch and accounts that bypass mailbox audit logging. Read-only.

Connect-ExchangeOnline -ShowBanner:$false

$auditDisabled = (Get-OrganizationConfig).AuditDisabled
Write-Output "AuditDisabled = $auditDisabled (False, the default, means mailbox auditing is allowed for the organisation)"

$bypass = @(Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object { $_.AuditBypassEnabled })
if ($bypass.Count -eq 0) {
    Write-Output 'No accounts bypass mailbox audit logging.'
}
$bypass | Sort-Object Name | Select-Object Name, AuditBypassEnabled

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• AuditDisabled False is the default and means mailbox auditing is allowed in the organisation. True turns mailbox auditing off for everyone.
• Accounts with AuditBypassEnabled True are exempt from mailbox audit logging in every mailbox. Microsoft describes bypass as a way to cut noise from trusted service accounts, so each entry should be a known service account.
• This doesn't check which actions are audited per mailbox (AuditOwner, AuditDelegate, AuditAdmin); the Manage mailbox auditing page covers those.
• ExchangeOnlineManagement 3.10.0 and later require PowerShell 7.6 when run in PowerShell 7 (Windows PowerShell 5.1 is unaffected), per the module release notes.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.