Comprehensive Detailed Explanation with References The command Set-AuditConfig -Workload Exchange is related to configuring auditing for workloads but does not enable mailbox auditing. To capture and view who is accessing User1's mailbox, mailbox auditing must be enabled at the mailbox level in Exchange Online. Correct solution would be: Set-Mailbox -Identity User1 -AuditEnabled $true Mailbox auditing is enabled by default for all mailboxes in Microsoft 365 now, but if it is disabled, enabling auditing at the mailbox level is required. Running Set-AuditConfig -Workload Exchange alone does not accomplish this. Reference: Mailbox auditing in Microsoft 365