Turn on the unified audit log

Description

Unified audit log ingestion is on for the organization (UnifiedAuditLogIngestionEnabled = True). User and administrator activities from Exchange Online, SharePoint, OneDrive, Teams, Microsoft Entra ID, Power Platform, Copilot and the other Microsoft 365 services are recorded and searchable in Microsoft Purview Audit.

Run the check in Exchange Online PowerShell: in Security & Compliance PowerShell the same cmdlet always returns False for this property.

Rationale

The unified audit log is the main source of evidence for Microsoft 365 incidents: mailbox rules created by an attacker, files downloaded, permissions granted, admin roles changed. It is on by default in most tenants but can be turned off by an administrator, sometimes by an attacker to hide activity. Every other logging control (export to the SIEM, alerting, retention) depends on it.

Impact

None known. Turning it on can take up to 60 minutes to apply.

Setting

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a member of a role group with the View-Only Audit Logs or Audit Logs role.
2. Browse to Solutions > Audit. If a banner offers Start recording user and admin activity, the log is off.
3. Run a search for the last 24 hours and check that results are returned.
4. Alternative in Exchange Online PowerShell (View-Only Organization Management is enough): Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled.
5. Fail if UnifiedAuditLogIngestionEnabled is False or the Audit page offers to start recording.

Remediation

1. Sign in to the Microsoft Purview portal with the Audit Logs role (for example Organization Management or Compliance Administrator).
2. Browse to Solutions > Audit and select Start recording user and admin activity.
3. Alternative in Exchange Online PowerShell (Audit Logs role): Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true.
4. Restrict who can turn it off (CB-M365-AUDIT-012) and alert on the change (audit operation Set-AdminAuditLogConfig).

Rollback

Not recommended. Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false stops recording.

References

• Turn auditing on or off Microsoft, vendor-doc, accessed 2026-10-24
• Get-AdminAuditLogConfig Microsoft, vendor-doc, accessed 2026-10-24
• Recommandations de sécurité pour l'architecture d'un système de journalisation ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC
• related CB-M365-AUDIT-003 Retain Microsoft 365 audit logs long enough for investigations
• related CB-M365-AUDIT-004 Enable Audit Premium events for all users
• related CB-M365-AUDIT-012 Restrict who can read, disable or shorten Microsoft 365 audit logs

People and lifecycle