# Enable Unified Audit Logging in Microsoft 365

## 1\. **What is Unified Audit Logging?**

* **Definition**: A Microsoft 365 feature that records and tracks user and admin activities across multiple services (Exchange Online, SharePoint, OneDrive, Teams, Power BI, Microsoft Entra ID, etc.).
    
* **Purpose**: Centralizes activity logs → helps in **security monitoring, compliance, and operational troubleshooting**.
    

---

## 2\. **Why it’s Important**

1. **Security & Compliance**
    
    * Detect suspicious/unauthorized activities (e.g., data breach, malware, policy violations).
        
    * Supports investigations and compliance reporting.
        
2. **Operational Efficiency**
    
    * Identifies configuration issues, service outages, or errors.
        
    * Helps resolve problems faster.
        
3. **User Behavior Insights**
    
    * Analyzes collaboration trends (e.g., file access, sharing).
        
    * Understands how employees use Microsoft 365 apps.
        

---

## 3\. **Types of Activities Captured**

* **Application administration** (adding/modifying apps, managing service principals, delegation).
    
* **Microsoft Defender for Identity** activities (when enabled).
    
* **User file interactions** (download, share, delete, move in SharePoint/OneDrive).
    
* **Sign-in and authentication events**.
    
* **Admin actions** (role assignments, mailbox changes).
    

---

## 4\. **Accessing Unified Audit Logs**

* Via **Microsoft Purview compliance portal** → Audit solution card.
    
* Activities are **grouped by service** for easier searching.
    
* Supports **custom searches** with filters like date, user, service, and activity type.
    
* Can export results to **CSV** or **Azure Storage**.
    

---

## 5\. **Retention of Logs**

* **Audit (Standard)** default = **180 days** (was 90 days before Oct 17, 2023).
    
* **Retention depends on license**:
    
    * Standard → 180 days.
        
    * Premium (E5 or add-on) → up to **1 year** or longer with custom retention.
        
* Retention period starts when log is added → adjusted if licensing/policies change.
    

---

## 6\. **Turning Unified Audit Logging On/Off**

* **Default**: Enabled for all new organizations.
    
* **Verification**:
    
    * Run in **Exchange Online PowerShell**:
        
        ```plaintext
        Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
        ```
        
        * `True` → Auditing ON
            
        * `False` → Auditing OFF
            

⚠️ Important: Running in **Security & Compliance PowerShell** always shows **False**, so only check in **Exchange Online PowerShell**.

* **Enable via GUI (Purview Compliance Portal)**:
    
    * Go to **Audit** → click **Start recording user and admin activity**.
        
* **Enable via PowerShell**:
    
    * Connect to Exchange Online PowerShell:
        
        ```plaintext
        Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
        ```
        
* Takes up to **1 hour** before logs start populating.
    

---

## 7\. **Risks of Turning OFF Auditing**

* No logs recorded → zero visibility.
    
* Office 365 Management Activity API, Microsoft Sentinel, and log searches return **no data**.
    
* Weakens compliance and forensic investigation capabilities.
    

---

## 8\. **Enhancing Audit Logging Experience**

1. **Configure Retention Policies**
    
    * Adjust log lifetime based on compliance needs.
        
    * Example: Standard = 180 days, Premium = up to 1 year.
        
2. **Search & Export**
    
    * Use filters for specific dates, users, or activities.
        
    * Export results for offline analysis or store in Azure.
        
3. **Create Alerts & Reports**
    
    * Example: Alert if "external file sharing" occurs.
        
    * Built-in reports: User activity, Sharing reports, etc.
        
    * Create custom alerts via GUI or PowerShell (`New-ProtectionAlert`).
        

---

## 9\. **Best Practices**

* Always **verify UAL status** after creating a new tenant.
    
* Set **custom retention** if compliance requires longer storage.
    
* Regularly **search/export logs** for investigations.
    
* Use **alerts** to automate suspicious activity detection.
    
* Avoid turning auditing off unless legally required.
    

---

# 🎯 Summary (What to Remember for Exams/Study)

* UAL = **Centralized activity logging across Microsoft 365**.
    
* **Enabled by default** but always verify (PowerShell).
    
* **Retention**: 180 days (Standard) → up to 1 year (Premium).
    
* **Access via Purview Compliance Portal** or PowerShell.
    
* **Critical for security, compliance, and investigations**.
    
* Turning it off = lose logs, API access, and alerts.