Again, another post pretty much for my reference.
The command to enable auditing across all mailboxes is:
Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true
Command has been taken from this excellent guide “1234n6: Investigating Office365 Account Compromise without the Activities API“.
thecomputerperson 