Does Set-Mailbox AuditEnabled Meet Delegate Sign-In Audit Goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You have a user named User1. Several users have full access to the mailbox of User1. Some email messages sent to User1 appear to have been read and deleted before the user viewed them. When you search the audit log in the Microsoft Purview compliance portal to identify who signed in to the mailbox of User1, the results are blank. You need to ensure that you can view future sign-ins to the mailbox of User1. Solution: You run the Set-Mailbox -Identity "User1" -AuditEnabled $true command. Does that meet the goal?
Community Votes
55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests whether you know that delegate MailboxLogin events require explicitly adding the MailboxLogin action to AuditDelegate settings, not just enabling mailbox auditing.
This SC-400 question asks whether running Set-Mailbox -Identity User1 -AuditEnabled $true lets you view future delegate sign-ins to User1's mailbox. The command only turns on general mailbox auditing, which is already enabled by default, and does not enable the MailboxLogin action for delegates, so it fails the goal.
Choosing Yes because you assume AuditEnabled $true is the switch that makes all mailbox sign-ins visible; in reality MailboxLogin for delegates is off by default even when auditing is enabled.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The goal is to record future sign-ins by delegates who have full access to User1's mailbox. In Microsoft 365, mailbox auditing is enabled by default for all mailboxes, and the Set-Mailbox -AuditEnabled $true command merely sets the mailbox's AuditEnabled flag to true (a no-op if already enabled). It does not add the MailboxLogin action to the delegate audit set. According to Microsoft Purview documentation, delegate sign-ins are not logged by default; you must explicitly add MailboxLogin to the mailbox's AuditDelegate settings using a command like Set-Mailbox -Identity User1 -AuditDelegate @{Add="MailboxLogin"}. Therefore running only Set-Mailbox -AuditEnabled $true does not meet the requirement to view future delegate sign-ins.Why the Other Options Are Wrong
Option A (Yes) is wrong because it assumes the command enables delegate sign-in logging. The command only toggles the mailbox audit status, and since auditing is already on by default, it changes nothing. It records hard and soft deletions by delegates, as Mr_Broekhoest noted, but not their logins. The blank audit results stem from the missing MailboxLogin action for delegates, not from auditing being globally off, so option A misdiagnoses the root cause.Community Comment Notes
SDiwan argues "Sign-in of Delegates are not logged by default" and says "this command does not enable audit log for delegates sign-ins," which correctly points to option B. Mr_Broekhoest also notes "You can not see delegate login" despite the command, reinforcing that AuditEnabled alone is insufficient. Amin4799 and CharlieGolf back option A, but their reasoning that AuditEnabled enables mailbox audit logging overlooks the default-on state and the need to add MailboxLogin for delegates. The community is split (55/45), and the majority vote for A does not override the technical requirement.Official Reference
Exam Strategy
For SC-400 mailbox audit questions, always check whether the scenario needs a specific audit action (MailboxLogin, MailItemsAccessed, etc.) rather than just toggling AuditEnabled. Remember that mailbox auditing is on by default, so commands that only set AuditEnabled $true are usually distractors.
Frequently Asked Questions
Why doesn't Set-Mailbox -AuditEnabled $true log delegate sign-ins?
Mailbox auditing is on by default, but the MailboxLogin action for delegates must be explicitly added with Set-Mailbox -AuditDelegate @{Add='MailboxLogin'} to record their sign-ins.
What command enables delegate sign-in auditing for User1's mailbox?
Run Set-Mailbox -Identity User1 -AuditDelegate @{Add='MailboxLogin'} to add MailboxLogin to the delegate audit set.