Suspicious Login Issues

What is an SPO Arbitration Mailbox in Exchange Audit Logs?

Partner Editor Sep 27, 2026 869 views

Question details

The user is seeking to understand what an SPO Arbitration mailbox is after receiving a SIEM alert about a Set-Mailbox event, which raised concerns regarding unauthorized forwarding.

What is an SPO Arbitration Mailbox in Exchange Audit Logs?

Product: Microsoft Exchange / SharePoint Online
Device & OS: not provided
Scenario: Reviewing security SIEM alerts and Exchange audit logs for potentially suspicious mailbox forwarding activities.
Observed behavior: A SIEM alert flags a Set-Mailbox event involving an SPO Arbitration recipient and Microsoft Exchange system activity, triggering unauthorized mailbox forwarding concerns.

Before you start

Ensure you have Exchange Administrator access and the necessary permissions in your Microsoft 365 Defender or Purview compliance portal to review full audit event logs.

Solution 1Recommended

Investigating and Validating SPO Arbitration Mailbox Alerts

Verify the system-generated background activity before tuning or excluding the SPO Arbitration mailbox from your SIEM alerts.

SPO_Arbitration mailboxes are not ordinary user mailboxes. They are system-generated mailboxes utilized strictly for internal background processes and routing between Microsoft Exchange and SharePoint Online.

When your SIEM software identifies a Set-Mailbox event involving these recipients, it often mimics the signature of unauthorized forwarding rules. However, this is typically standard, benign system activity rather than a security breach.

Access Exchange Audit Logs

Log into your Microsoft 365 Defender or Microsoft Purview compliance portal and navigate to the Audit search section to locate the specific event.

Examine the Set-Mailbox Event

Filter by the exact timestamp from your SIEM alert and find the record indicating the Set-Mailbox command executed on the 'SPO_Arbitration' recipient.

Verify Surrounding Tenant Activity

Analyze the log entries immediately before and after the alert to confirm that the activity correlates with expected internal SharePoint Online synchronization or Exchange operations.

Tune Your SIEM Exclusions

Once you have verified that the event is normal system behavior, adjust your SIEM detection rules to exclude expected actions for SPO_Arbitration mailboxes, preventing future false positives.

Investigating and Validating SPO Arbitration Mailbox Alerts

Verification is Essential: Do not broadly exclude all arbitration mailboxes from SIEM alerts without first confirming that the flagged behavior aligns with expected operations in your specific tenant environment.

Free Microsoft Office alternative

Analyze Your Exported SIEM Audit Logs with WPS Office

While Microsoft Exchange manages your enterprise email routing and system alerts, WPS Office provides a free, lightweight suite perfectly suited for opening and analyzing exported CSV/XLSX audit reports, documenting security policies, and handling administrative documentation.

1. Download the Suite: Visit the official WPS Office website and download the free installer for your operating system.
2. Install WPS Office: Run the setup file and follow the quick installation prompts to set up Writer, Spreadsheet, and Presentation.
3. Analyze Audit Data: Open your exported SIEM alerts or Exchange audit logs (.csv format) in WPS Spreadsheet to utilize advanced filtering and pivot tables for security analysis.

Fully compatible with Microsoft Excel (.xlsx and .csv) for deep analysis of exported Exchange audit logs.Free and lightweight office suite including Writer, Spreadsheet, and Presentation tools.Familiar tabbed user interface, ensuring a zero-learning-curve transition for admins.Cross-platform support for Windows, Mac, Linux, iOS, and Android to review security logs anywhere.

microsoft office alternative - wps office

Frequently Asked Questions

Can a hacker use an SPO Arbitration mailbox to forward external emails?

While SPO Arbitration mailboxes are inherently system-generated and restricted, it is theoretically possible for an attacker with high-level administrative credentials to tamper with them. This is why you must review the full audit log to ensure the Set-Mailbox event represents normal internal SharePoint and Exchange synchronization rather than malicious configuration.

How do I find a list of all arbitration mailboxes in my Exchange tenant?

You can view all system-generated arbitration mailboxes by connecting to Exchange Online PowerShell using admin credentials and executing the command 'Get-Mailbox -Arbitration'. This displays the hidden mailboxes used for workflows, routing, and internal tracking.

Should I delete SPO_Arbitration mailboxes to stop the SIEM alerts?

No. You should never delete SPO Arbitration or any other system-generated mailboxes. They are critical for the functionality of internal Microsoft 365 processes, including approvals, eDiscovery, and SharePoint integration. Deleting them will cause severe operational errors in your environment.

Microsoft Office Security Issues