[fowl2]

> When you run Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled, the AuditEnabled property always displays as True. This hardcoded display value doesn't reflect the actual mailbox-level audit configuration.

> To verify the actual mailbox audit status, use the Filter parameter in the following command: PowerShell

> Get-Mailbox -Identity <MailboxIdentity> -Filter "AuditEnabled -eq 'True'"| Format-List

> If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.

https://learn.microsoft.com/en-us/purview/audit-mailboxes?so...