When you run Get-Mailbox -Identity <MailboxIdentity> | Format-List AuditEnabled, the AuditEnabled property always displays as True. This hardcoded display value doesn't reflect the actual mailbox-level audit configuration.
To verify the actual mailbox audit status, use the Filter parameter in the following command:
PowerShell
If the command returns the mailbox object, mailbox-level auditing is enabled. If the command returns an error stating the object couldn't be found, mailbox-level auditing is disabled.
Comments
https://learn.microsoft.com/en-us/purview/audit-mailboxes?so...