Journaling: the regulated-copy machine
Journal RULES copy messages (per scope — recipients, internal/external) to a journaling mailbox, typically OUTSIDE the tenant (a third-party archive, because journaling your own tenant to your own tenant fails the independence some regulations want). The reports wrap the original with envelope metadata (true senders/recipients incl. BCC and DL-expanded — the forensic value). It's the FINRA/regulated-industry primitive, distinct from modern records management — Microsoft's direction pushes retention+eDiscovery for most, journaling for the specifically-regulated.
The catch that bites: no journaling mailbox INSIDE Exchange Online is supported as the target — the destination must be external/on-prem; NDRs on journal reports (journaling mailbox unreachable) can spool and, historically, cause pressure — monitor the journal target's health like production.
Mailbox auditing: the action log
On by default now, mailbox audit logs record actions BY owners, delegates and admins (mail read/moved/deleted, folder changes, sends) into the mailbox audit log, surfaced through the unified audit log and specialised searches. This is the investigator's tool: 'did the delegate read the CEO's mail', 'what did the compromised account touch', 'who deleted the evidence' (the mailbox-species and BEC concepts' proof layer). Retention of these logs and which actions are captured are tunable — and worth verifying rather than assuming, because 'auditing is on' and 'the action you need was captured and retained long enough' are different claims.
What to watch (proofs)
- Journaling config + target health: Get-JournalRule + the target mailbox's reachability/NDR trend — a silently-failing journal is a compliance hole that looks like nothing.
- Audit coverage test: perform known actions (delegate reads, deletes), find them in Search-MailboxAuditLog / unified audit — the quarterly regression (is auditing REALLY capturing what investigations will need?).
- Retention runway on audit data: the log's oldest retrievable action vs your investigation-window requirement (the Teams audit concept's rule, mail edition).
- Delegate/admin action baselines: mailbox audit review on sensitive mailboxes (execs, finance) — the standing insider-risk read, not just the post-incident scramble.