This guide explains how to configure the Microsoft 365 audit log, how to search it and what its limits are.
When something suspicious happens in Microsoft 365, such as a mailbox rule you did not create, files shared externally or a strange sign-in, the audit log is where you find out who did what and when. It records user and administrator activity across Exchange, SharePoint, OneDrive, Teams and more. Here is how to make sure it is switched on and how to search it.
What the audit log records
The unified audit log captures activities such as sign-ins, file access and sharing, mailbox actions, permission changes, admin changes and Teams activity. It is a key source of evidence for security incidents, compliance reviews and investigations into data leaks.
Check that auditing is turned on
In most Microsoft 365 tenants auditing is on by default, but it is worth confirming, especially for older tenants. In Exchange Online PowerShell you can check the setting with the command Get-AdminAuditLogConfig and look at the unified audit log ingestion value. If it is off, it can be turned on with Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true, and it can take some time to start collecting.
How to run an audit log search
- Sign in to the Microsoft Purview portal with an account that has audit permissions.
- Open the Audit section and start a new search.
- Set a date and time range, and optionally filter by user, activity or file, folder or site.
- Run the search and wait for results, which can take a few minutes for large ranges.
- Filter or sort the results, open entries to see details, and export them to CSV if you need to analyse them further.
Retention
With Audit (Standard), records are kept for 180 days. Audit (Premium), available with some higher licences, keeps records for longer and captures additional high-value events. If you may need to investigate older activity, check your retention early, because you cannot search for records that have already expired.
Limitations of native audit searches
- Results can be slow and may be capped for large searches.
- Records are not always available immediately.
- Searching, correlating and alerting across many events is manual.
- Retention is limited unless you have extended licensing or export logs elsewhere.
Other ways to access audit data
For ongoing monitoring, organisations can search with PowerShell, use the Office 365 Management Activity API to feed logs into a security information and event management tool, or set up alert policies in Microsoft Purview and Microsoft Defender so the right people are notified of risky activity.
Best practice
- Confirm auditing is enabled when you take over or set up a tenant.
- Restrict who can search the audit log.
- Set up alerts for risky events such as new forwarding rules and mass downloads.
- Export or archive logs if you need longer than your licence retains.
Key takeaways
- The unified audit log records user and admin activity across Exchange, SharePoint, OneDrive, Teams and more.
- Auditing is on by default in most tenants, but it is worth confirming, especially for older tenants.
- Audit (Standard) keeps records for 180 days, so check retention early, because expired records cannot be searched.
Microsoft 365 audit log: frequently asked questions
What does the Microsoft 365 audit log record?
Sign-ins, file access and sharing, mailbox actions, permission changes, admin changes and Teams activity. It is a key source of evidence for security incidents, compliance reviews and investigations into data leaks.
How do I check that auditing is turned on?
In Exchange Online PowerShell, run Get-AdminAuditLogConfig and look at the unified audit log ingestion value. If it is off, it can be turned on with Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true, and it can take some time to start collecting.
How long is audit data kept?
With Audit (Standard), records are kept for 180 days. Audit (Premium), available with some higher licences, keeps records for longer and captures additional high-value events.
Related reading: Microsoft Purview consulting.
Total Solutions IT can review your Microsoft 365 auditing and alerting. Call 02 6061 4222 to find out more.
