Detections
Analytics

MS.DEFENDER.6.1v1 - Unified Audit logging SHALL be enabled.

Information

Responding to incidents without detailed information about activities that took place slows response actions. Enabling Unified Audit logging helps ensure agencies have visibility into user actions. Furthermore, enabling the Unified Audit log is required for government agencies by OMB M-21-31.

Solution

To enable auditing via the Microsoft Purview portal:

1. Sign in to the Microsoft Purview portal.

2. Under Solutions, select Audit.

3. If auditing is not enabled, a banner is displayed to notify the
administrator to start recording user and admin activity.

4. Click the Start recording user and admin activity.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12

Plugin: microsoft_azure

Control ID: 73ece2159206558a8acfceb3b0ccb145c5a4bd4ebdedc4758270ba5751374742