> When you run Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled, the AuditEnabled property always displays as True. This hardcoded display value doesn't reflect the actual mailbox-level audit configuration.
> To verify the actual mailbox audit status, use the Filter parameter in the following command:
PowerShell
> If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.
> To verify the actual mailbox audit status, use the Filter parameter in the following command: PowerShell
> Get-Mailbox -Identity <MailboxIdentity> -Filter "AuditEnabled -eq 'True'"| Format-List
> If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.
https://learn.microsoft.com/en-us/purview/audit-mailboxes?so...