Hello,

We have begun validating the findings from the Microsoft 365 Security Inspector report against the live tenant configuration and have identified several items that appear to be false positives or may be based on stale detection data.

Finding #12 – Mailbox Auditing Should be Enabled at Tenant Level

We validated the tenant configuration using:

Get-OrganizationConfig | Select AuditDisabled

Resultes: AuditDisabled : False

Finding #99 – Mailboxes Without Mailbox Auditing Enabled

Because mailbox auditing is enabled globally (AuditDisabled : False), this finding may be relying on mailbox-level settings that have been superseded by the tenant-wide configuration. We would appreciate clarification on how this finding was generated.

Finding #71 – Unified Audit Log Search Is Not Enabled

Get-AdminAuditLogConfig

UnifiedAuditLogIngestionEnabled : False

However, when querying the Unified Audit Log:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 5

the command successfully returned multiple recent audit events. This confirms that audit records are actively being collected and are searchable within the tenant. Based on this validation, the finding appears inconsistent with the current tenant state.

Finding #72 – External Sender Message Tagging Not Enabled

We validated using: Get-ExternalInOutlook

Results: Enabled : True

External sender tagging is currently enabled in the tenant, therefore this finding also appears to be a false positive.

Request

Could you please review the detection methodology and scan results associated with Findings #12, #71, #72, and #99 and advise why these findings were reported despite the current tenant configuration indicating otherwise?

We are continuing validation of the remaining findings and wanted to raise these discrepancies before proceeding with remediation efforts.

Thank you,

Jason Johnson

President

Streamline Networks, Inc.