Detections
Analytics

3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 180 days by default. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.

Enabling audit log search in the Microsoft Purview compliance portal can help organizations improve their security posture, meet regulatory compliance requirements, respond to security incidents, and gain valuable operational insights.

Solution

To remediate using the UI:

 - Navigate to Microsoft Purview https://purview.microsoft.com/
 - Select Solutions and then Audit to open the audit search.
 - Click blue bar Start recording user and admin activity.
 - Click Yes on the dialog box to confirm.

 To remediate using PowerShell:

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following PowerShell command:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: microsoft_azure

Control ID: 7b556c6ae47db223a6ba6d307c62b883f68aa4de3436150892e0842a0b7a4ba6