Email is still the most common way data leaves an organization — deliberately or not. Which is why message and email compliance is one of the first things an auditor asks about, and one of the last things busy IT teams actually audit.
This post is a practical guide to auditing email compliance in Microsoft 365: what to check, why it matters, and how to get evidence without living in the Exchange admin center.
What "email compliance auditing" means
It is the practice of verifying that your Exchange Online and tenant-wide mail configuration meets the controls your organization is measured against: anti-phishing and anti-spam defaults, mail-flow rules, mailbox auditing, data-loss prevention, and retention.
It is not just "is anti-spam on?" It is whether the configuration that is supposed to protect and record email is actually in place, and stayed in place.
The controls that matter most
A practical email compliance review covers:
1. External forwarding. Users can configure mailbox rules that forward mail outside the tenant. That is a classic exfiltration path and a common audit finding. The right configuration blocks or restricts automatic external forwarding, with exceptions where genuinely needed.
2. Anti-phishing and anti-spam defaults. Exchange Online protection policies should be tuned — not left at permissive defaults. Check the anti-phishing policy, impersonation protection, and safe-attachment/safe-link behaviour.
3. Mailbox auditing. Every mailbox should have auditing enabled so that mailbox-level actions (delegation changes, mailbox rule changes, logins) are recorded. Auditing off means an incident in that mailbox is invisible.
4. Mail flow and transport rules. Review transport rules for anything that forwards, copies, or filters mail in unexpected ways — including rules left behind by departed admins.
5. DLP and retention. Confirm that data-loss prevention policies and retention labels are applied where required, and that they match your stated compliance posture.
6. Legacy protocols. SMTP AUTH and basic authentication on mail protocols are a compliance and security problem at once — they bypass MFA and controls.
Why this is hard to do properly
The friction is the same as everywhere in Microsoft 365:
- It is spread across consoles. Some settings live in the Exchange admin center, some in Purview, some in Entra ID.
- It is point-in-time. A transport rule someone adds next week is invisible to today's review.
- It requires mapping. "External forwarding is allowed" only means something when it is tied to the control your auditor measures.
So teams either over-invest (living in the admin center) or under-invest (never checking), and both end up exposed.
How to audit it, practically
Two viable approaches:
Manual: Work through the Exchange admin center and Purview, checking each control against your framework. Thorough, slow, and easy to let lapse.
Hosted audit: Run an automated, read-only audit that checks Exchange Online configuration as one of several surfaces, maps each finding to its control (CIS, CISA SCUBA, ORCA, and so on), and produces a dated report. You get the email-compliance evidence alongside identity, Teams, SharePoint, and Defender — in one pass.
The second approach is what we built M365Audit for. The Exchange checks run as part of every audit; you can see the framework coverage on the ORCA benchmark page and the output in the sample report.
The short version
Email compliance is where a lot of real risk lives — external forwarding, weak anti-phishing defaults, disabled mailbox auditing. Audit it explicitly, map it to a framework, and do it on a schedule so you have evidence, not a memory.
Run an audit to check your Exchange Online compliance configuration in minutes.