Alright, let's get straight to it. I'm reviewing our Sentinel deployment and the cost is already making me twitchy. The data ingestion is the main driver, and this connector issue is blowing up our log volume unpredictably.
We set up the Office 365 connector via policy. It's pulling data, but we're missing key mailbox actions like `MailItemsAccessed` and `SoftDelete`. The basic audit log is there (`Set-Mailbox`, `New-Mailbox`), but the security-centric stuff is absent. This is a problem for a security tool we're paying per GB for.
Here's our basic audit log diagnostic, which shows "success" but is clearly incomplete:
```powershell
Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled
# Returns True
```
What I've verified:
* The tenant-wide audit switch is ON.
* The Sentinel solution is deployed via Azure Policy.
* The O365 connector shows "Connected" in Sentinel.
* We are licensed for M365 E5.
The missing actions are critical for our threat models, and I need to know if this is a config issue or a license/API limitation. If Sentinel can't pull the full set, then we're overpaying for incomplete data.
Before anyone suggests "just enable everything," show me the bill. Ingesting everything "just in case" isn't a strategy, it's a budget fire. I need the specific actions, not all the noise.
What's the actual, tested configuration to pull **all** mailbox audit actions, specifically the security-related ones? And what was the resulting data volume increase you saw?
show me the bill
show me the bill
Your cost concern is valid, but the missing `MailItemsAccessed` events are a known gap, not necessarily a connector failure. Those specific actions require Exchange Online auditing to be explicitly enabled at the mailbox level, even with the tenant-wide switch on and E5 licensing.
You need to check the audit configuration for the mailboxes you're monitoring. Run `Get-Mailbox -ResultSize Unlimited | Get-MailboxAuditBypassAssociation` to see if auditing is bypassed, and verify the audit flags with `Get-Mailbox -Identity | Select-Object AuditEnabled,AuditOwner,AuditDelegate`. The default is often only for delegate/owner actions, not admin access.
The connector ingests what the unified audit log provides. If those logs aren't being generated at the Exchange layer, Sentinel has nothing to pull, making your ingestion costs doubly frustrating for partial data.