Does Set-Mailbox AuditEnabled Meet Delegate Sign-In Audit Goal?

SC-400 By islever Editorial Last updated

Short answer

B Set-Mailbox -AuditEnabled $true toggles general auditing but doesn't enable MailboxLogin for delegates, so delegate sign-ins to User1's mailbox stay unlogged.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You have a user named User1. Several users have full access to the mailbox of User1. Some email messages sent to User1 appear to have been read and deleted before the user viewed them. When you search the audit log in the Microsoft Purview compliance portal to identify who signed in to the mailbox of User1, the results are blank. You need to ensure that you can view future sign-ins to the mailbox of User1. Solution: You run the Set-Mailbox -Identity "User1" -AuditEnabled $true command. Does that meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

Tests whether you know that delegate MailboxLogin events require explicitly adding the MailboxLogin action to AuditDelegate settings, not just enabling mailbox auditing.

This SC-400 question asks whether running Set-Mailbox -Identity User1 -AuditEnabled $true lets you view future delegate sign-ins to User1's mailbox. The command only turns on general mailbox auditing, which is already enabled by default, and does not enable the MailboxLogin action for delegates, so it fails the goal.

Common mistake: Choosing Yes because you assume AuditEnabled $true is the switch that makes all mailbox sign-ins visible; in reality MailboxLogin for delegates is off by default even when auditing is enabled.

Expert Analysis

Why the Answer Is Correct

The goal is to record future sign-ins by delegates who have full access to User1's mailbox. In Microsoft 365, mailbox auditing is enabled by default for all mailboxes, and the Set-Mailbox -AuditEnabled $true command merely sets the mailbox's AuditEnabled flag to true (a no-op if already enabled). It does not add the MailboxLogin action to the delegate audit set. According to Microsoft Purview documentation, delegate sign-ins are not logged by default; you must explicitly add MailboxLogin to the mailbox's AuditDelegate settings using a command like Set-Mailbox -Identity User1 -AuditDelegate @{Add="MailboxLogin"}. Therefore running only Set-Mailbox -AuditEnabled $true does not meet the requirement to view future delegate sign-ins.

Why the Other Options Are Wrong

Option A (Yes) is wrong because it assumes the command enables delegate sign-in logging. The command only toggles the mailbox audit status, and since auditing is already on by default, it changes nothing. It records hard and soft deletions by delegates, as Mr_Broekhoest noted, but not their logins. The blank audit results stem from the missing MailboxLogin action for delegates, not from auditing being globally off, so option A misdiagnoses the root cause.

Community Comment Notes

SDiwan argues "Sign-in of Delegates are not logged by default" and says "this command does not enable audit log for delegates sign-ins," which correctly points to option B. Mr_Broekhoest also notes "You can not see delegate login" despite the command, reinforcing that AuditEnabled alone is insufficient. Amin4799 and CharlieGolf back option A, but their reasoning that AuditEnabled enables mailbox audit logging overlooks the default-on state and the need to add MailboxLogin for delegates. The community is split (55/45), and the majority vote for A does not override the technical requirement.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-mailboxes

This link opens the official vendor documentation in a new tab.

Exam Strategy

For SC-400 mailbox audit questions, always check whether the scenario needs a specific audit action (MailboxLogin, MailItemsAccessed, etc.) rather than just toggling AuditEnabled. Remember that mailbox auditing is on by default, so commands that only set AuditEnabled $true are usually distractors.

Frequently Asked Questions

Why doesn't Set-Mailbox -AuditEnabled $true log delegate sign-ins?

Mailbox auditing is on by default, but the MailboxLogin action for delegates must be explicitly added with Set-Mailbox -AuditDelegate @{Add='MailboxLogin'} to record their sign-ins.

What command enables delegate sign-in auditing for User1's mailbox?

Run Set-Mailbox -Identity User1 -AuditDelegate @{Add='MailboxLogin'} to add MailboxLogin to the delegate audit set.

More SC-400 FAQ →

Community Votes

A
55%
B
45%

55% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. SDiwan 👍 4 Answered B
    The goal of the question is to enable logs for sign-ins of other users who have full access to the mailbox, these users are called "Delegates". Sign-in of Delegates are not logged by default. it needs to be manually enabled, this command does not enable audit log for delegates sign-ins.
  2. Amin4799 👍 2 Answered A
    A-Yes The -AuditEnabled $true parameter enables mailbox audit logging for User1.
  3. CharlieGolf 👍 2 Answered A
    Correct. https://learn.microsoft.com/en-us/purview/audit-mailboxes
  4. sswitzer 👍 1 Answered A
    From chatgpt: Yes, running the Set-Mailbox -Identity "User1" -AuditEnabled $true command helps meet the goal of viewing future sign-ins to the mailbox of User1. This command enables mailbox audit logging for the specified mailbox (User1).
  5. Mr_Broekhoest 👍 1 Answered A
    You can not see delegate login or emails read but you can see hard and soft deletions by delegates with this command.
Show 1 more comment
  1. smicu 👍 1 Answered B
    SDiwan explanation is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Add an Information Barrier Segment to SharePoint Site1

S-grade

Enforcing Sensitivity Labels for Microsoft 365 Groups

S-grade

Which Locations Can Be Configured for a Subject Rights Request?

S-grade

Activate ISO/IEC 27001:2013 Template in Compliance Manager

S-grade

← Back to SC-400 Study Guide