Thanks for this just wanted to add some bits

[stonefr33]

For your command I would recommend the Get-EXOMailbox just because it is faster especially with large numbers of users.

A comment from MS on the AuditingEnabled property as this has thrown me off in the past

Get-Mailbox –ResultSize Unlimited -Filter "AuditEnabled -ne '$true' -and PersistedCapabilities -ne 'BPOS_S_EquivioAnalytics' -and PersistedCapabilities -ne 'M365Auditing'" 

Note: You must use a server-side filter to make Exchange Online determine which mailboxes have not been explicitly enabled because the value of the AuditEnabled property will always be True for mailboxes covered by global auditing.

One other thing, in the persistedcapabilities attribute you want to check for 'BPOS_S_ThreatIntelligenceAddOn', this as far as I can tell indicates E5 or E5 Auditing add on which gets you a couple more auditing settings.

            $DefaultAuditAdmin.add('Send')
            $DefaultAuditAdmin.add('MailItemsAccessed')

            $DefaultAuditDelegate.add('MailItemsAccessed')

            $DefaultAuditOwner.add('Send')
            $DefaultAuditOwner.add('MailItemsAccessed')

I have some functions I need to polish off which I'll try to share next week