{
  "id": "CB-M365-AUDIT-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-001",
    "title": "Turn on the unified audit log",
    "finding": {
      "title": "User and administrator activity in Microsoft 365 is not recorded in the unified audit log",
      "description": "Without audit log ingestion, mailbox access, file sharing, admin changes and many security events leave no searchable trace, and an intrusion cannot be investigated."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "critical"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "unified-audit-log",
      "purview",
      "incident-response"
    ],
    "description": "Unified audit log ingestion is on for the organization (`UnifiedAuditLogIngestionEnabled` =\n`True`). User and administrator activities from Exchange Online, SharePoint, OneDrive, Teams,\nMicrosoft Entra ID, Power Platform, Copilot and the other Microsoft 365 services are recorded and\nsearchable in Microsoft Purview **Audit**.\n",
    "rationale": "The unified audit log is the main source of evidence for Microsoft 365 incidents: mailbox rules\ncreated by an attacker, files downloaded, permissions granted, admin roles changed. It is on by\ndefault in most tenants but can be turned off by an administrator, sometimes by an attacker to\nhide activity. Every other logging control (export to the SIEM, alerting, retention) depends on\nit.\n",
    "impact": "None known. Turning it on can take up to 60 minutes to apply.\n",
    "notes": "Run the check in Exchange Online PowerShell: in Security & Compliance PowerShell the same cmdlet\nalways returns `False` for this property.\n",
    "setting": {
      "location": "Microsoft Purview portal > Solutions > Audit (Exchange Online Get-AdminAuditLogConfig UnifiedAuditLogIngestionEnabled)",
      "default_value": "True (most tenants)",
      "recommended_value": "True"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a member\n   of a role group with the View-Only Audit Logs or Audit Logs role.\n2. Browse to **Solutions** > **Audit**. If a banner offers **Start recording user and admin\n   activity**, the log is off.\n3. Run a search for the last 24 hours and check that results are returned.\n4. Alternative in Exchange Online PowerShell (View-Only Organization Management is enough):\n   `Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled`.\n5. Fail if `UnifiedAuditLogIngestionEnabled` is `False` or the Audit page offers to start\n   recording.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Purview portal with the Audit Logs role (for example Organization\n   Management or Compliance Administrator).\n2. Browse to **Solutions** > **Audit** and select **Start recording user and admin activity**.\n3. Alternative in Exchange Online PowerShell (Audit Logs role):\n   `Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true`.\n4. Restrict who can turn it off (CB-M365-AUDIT-012) and alert on the change (audit operation\n   `Set-AdminAuditLogConfig`).\n",
      "rollback": "Not recommended. `Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false` stops\nrecording.\n"
    },
    "references": [
      {
        "title": "Turn auditing on or off",
        "url": "https://learn.microsoft.com/purview/audit-log-enable-disable",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Get-AdminAuditLogConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/get-adminauditlogconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommandations de sécurité pour l'architecture d'un système de journalisation",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SECURITYSUITE.5.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R2",
        "relation": "partial",
        "note": "Applies the recommendation to Microsoft 365 services only."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-2",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.008"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-004",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}