Mailbox item-access auditing was never enabled — the owner asks whether the intruder read the CFO's mail. What can you honestly say?

## The claim you are being asked to make "Did they read it" is a question about *access*, and access to individual mail items is only visible if the platform was configured — and licensed — to record item access, and if the record has not aged out. Three independent conditions, all silent when they fail. Nothing in your search results distinguishes "the intruder did not open anything" from "this source never emitted access events". That indistinguishability is the whole content of the question. ## The directional error to avoid Absence of a record is evidence of non-occurrence **only** when you can show the record would have existed had the event occurred. Formally you need three things: 1. **Emission** — the source generates that event type at all (feature, licence tier, audit configuration). 2. **Coverage** — it was enabled for *this* mailbox, for *this* period. 3. **Retention** — the events still exist and your search covered the full window. Break any one and "we found nothing" carries no information. This is the mail-trail instance of a rule that runs through the whole discipline: a detection that never fired tells you nothing about the estate unless you have independently shown it would have fired. ## What you say, in report language Compare two sentences that a reader will treat very differently: - *"There is no evidence the mailbox contents were accessed."* — read downstream as "the mail was not read", and it will end up in a customer notice or a regulator answer in that form. - *"Item-level access events are not collected in this tenant, so access can be neither confirmed nor excluded. The mailbox is treated as exposed for the period the intruder's session was active."* — states the capability of the source, then states your assessment and its basis. The second sentence is longer and it is the one to write. Say what the source can do, then say what you concluded and from what. Never let the shape of your search stand in for a finding. ## What you can still say from the trails you do have Quite a lot, and a strong candidate pivots straight to it rather than stopping at the gap: - **Bounding**: sign-in and session records give the window during which a credential was accepted from the intruder's client. Everything in the mailbox at that time is *reachable*, and reachable is the assessment you can defend. - **What definitely left**: if an inbox rule or a forwarding setting was in place, the message trace shows the messages that matched and where they were sent. That is not an inference — it is delivery evidence for a specific set of messages. - **The rule's criteria**: a keyword filter is a statement of what the intruder was hunting, and it narrows the set of items you should assume were seen. - **Bulk signals**: some tenants record client sync or export activity even where per-item reads are absent, and a large export leaves a footprint in other places — device, endpoint or network telemetry — that no mailbox setting controls. - **Content sensitivity**: what the mailbox actually held over that window is often the decisive input for the notification call, and that is answerable regardless of access logging. ## The counter-case, because interviewers ask it Suppose item-access events *do* exist and show nothing. You are still not finished. Qualify by retention, and understand the event's own granularity: some clients register a folder-level synchronisation rather than one record per message opened, so a single event can cover a large set of items, and a mailbox cached offline can be read with no further server-side record at all. "Access is not recorded despite the source emitting such events" is a stronger statement than the first case, but it is still a statement about records, not about the intruder's eyes. ## The remediation you owe Enable per-item access auditing where the tenant supports it, verify the events actually arrive with a controlled test, and record the configuration gap as a finding in its own right — the incident is what exposed it. Be explicit that logging is not retroactive: turning it on today does nothing for the window under investigation, and implying otherwise to a business owner is worse than the gap. ## Why this is the senior version of the question A junior answers by running the search. A senior answers by knowing what the search *could* have returned, saying so before quoting a result, and giving the business a defensible assessment built from the sources that do exist — while resisting the pressure to convert an empty result set into reassurance.