Enable Unified Audit Logging in Microsoft 365
Cloud and systems engineer with a strong foundation in networking, automation, and infrastructure design. I write about real-world challenges, best practices, and evolving trends in cloud computing, system administration, and network architecture.
1. What is Unified Audit Logging?
Definition: A Microsoft 365 feature that records and tracks user and admin activities across multiple services (Exchange Online, SharePoint, OneDrive, Teams, Power BI, Microsoft Entra ID, etc.).
Purpose: Centralizes activity logs → helps in security monitoring, compliance, and operational troubleshooting.
2. Why it’s Important
Security & Compliance
Detect suspicious/unauthorized activities (e.g., data breach, malware, policy violations).
Supports investigations and compliance reporting.
Operational Efficiency
Identifies configuration issues, service outages, or errors.
Helps resolve problems faster.
User Behavior Insights
Analyzes collaboration trends (e.g., file access, sharing).
Understands how employees use Microsoft 365 apps.
3. Types of Activities Captured
Application administration (adding/modifying apps, managing service principals, delegation).
Microsoft Defender for Identity activities (when enabled).
User file interactions (download, share, delete, move in SharePoint/OneDrive).
Sign-in and authentication events.
Admin actions (role assignments, mailbox changes).
4. Accessing Unified Audit Logs
Via Microsoft Purview compliance portal → Audit solution card.
Activities are grouped by service for easier searching.
Supports custom searches with filters like date, user, service, and activity type.
Can export results to CSV or Azure Storage.
5. Retention of Logs
Audit (Standard) default = 180 days (was 90 days before Oct 17, 2023).
Retention depends on license:
Standard → 180 days.
Premium (E5 or add-on) → up to 1 year or longer with custom retention.
Retention period starts when log is added → adjusted if licensing/policies change.
6. Turning Unified Audit Logging On/Off
Default: Enabled for all new organizations.
Verification:
Run in Exchange Online PowerShell:
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabledTrue→ Auditing ONFalse→ Auditing OFF
⚠️ Important: Running in Security & Compliance PowerShell always shows False, so only check in Exchange Online PowerShell.
Enable via GUI (Purview Compliance Portal):
- Go to Audit → click Start recording user and admin activity.
Enable via PowerShell:
Connect to Exchange Online PowerShell:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Takes up to 1 hour before logs start populating.
7. Risks of Turning OFF Auditing
No logs recorded → zero visibility.
Office 365 Management Activity API, Microsoft Sentinel, and log searches return no data.
Weakens compliance and forensic investigation capabilities.
8. Enhancing Audit Logging Experience
Configure Retention Policies
Adjust log lifetime based on compliance needs.
Example: Standard = 180 days, Premium = up to 1 year.
Search & Export
Use filters for specific dates, users, or activities.
Export results for offline analysis or store in Azure.
Create Alerts & Reports
Example: Alert if "external file sharing" occurs.
Built-in reports: User activity, Sharing reports, etc.
Create custom alerts via GUI or PowerShell (
New-ProtectionAlert).
9. Best Practices
Always verify UAL status after creating a new tenant.
Set custom retention if compliance requires longer storage.
Regularly search/export logs for investigations.
Use alerts to automate suspicious activity detection.
Avoid turning auditing off unless legally required.
🎯 Summary (What to Remember for Exams/Study)
UAL = Centralized activity logging across Microsoft 365.
Enabled by default but always verify (PowerShell).
Retention: 180 days (Standard) → up to 1 year (Premium).
Access via Purview Compliance Portal or PowerShell.
Critical for security, compliance, and investigations.
Turning it off = lose logs, API access, and alerts.
