{
  "id": "CB-M365-AUDIT-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-002.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-002",
    "title": "Forward Microsoft 365 security logs to the SIEM or SOC",
    "finding": {
      "title": "Microsoft 365 security logs are not collected by the security operations center",
      "description": "Sign-ins, directory changes and workload audit events stay inside Microsoft 365, so the SOC cannot correlate them, alert on them in real time or keep them beyond native retention."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "siem",
      "soc",
      "sentinel",
      "entra-id",
      "defender",
      "intune"
    ],
    "description": "The following logs are collected continuously, close to real time, by the organization's SIEM or\nSOC platform (Microsoft Sentinel or another product):\n\n- Microsoft Entra ID: sign-in logs (interactive, non-interactive, service principal, managed\n  identity), audit logs, provisioning logs, risky users and risk detections, through **Diagnostic\n  settings** to a Log Analytics workspace, an event hub or a partner solution;\n- Microsoft 365 unified audit log (Exchange, SharePoint, OneDrive, Teams, Power Platform,\n  Copilot), through the Office 365 Management Activity API or the Microsoft 365 connector;\n- Microsoft Defender XDR incidents, alerts and advanced hunting events, through the streaming API\n  or the Defender XDR connector;\n- Microsoft Intune audit and operational logs, through Intune **Diagnostic settings**.\n\nThe collection chain is monitored: an alert is raised when a source stops sending events, and its\ncoverage is reviewed at least once a year.\n",
    "rationale": "Native consoles keep logs for a limited time and do not correlate Microsoft 365 events with\non-premises, network and endpoint signals. Central collection lets the SOC detect an attack that\nstarts with a phished account and continues on the network, keeps evidence out of reach of a\ntenant administrator who would tamper with it, and supports the retention requirements of\nCB-M365-AUDIT-003. Monitoring the chain detects a disabled export, a frequent attacker move.\n",
    "impact": "Log Analytics, event hub or SIEM ingestion has a cost proportional to volume (non-interactive\nsign-ins and audit logs are large). Diagnostic settings require an Azure subscription.\n",
    "notes": "Diagnostic settings and Management Activity API subscriptions are not exposed through Microsoft\nGraph: the evidence is a screenshot or export of the configuration and a query in the SIEM.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader and browse to **Entra ID** > **Monitoring & health** > **Diagnostic settings**.\n   Check that a setting sends at least `AuditLogs`, `SignInLogs`, `NonInteractiveUserSignInLogs`,\n   `ServicePrincipalSignInLogs`, `ManagedIdentitySignInLogs`, `ProvisioningLogs`, `RiskyUsers`\n   and `UserRiskEvents` to the SIEM destination.\n2. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a\n   Read Only Operator and browse to **Reports** > **Diagnostic settings**; check that\n   `AuditLogs` and `OperationalLogs` are sent.\n3. In the SIEM, check that the Microsoft 365 (Office 365) and Microsoft Defender XDR connectors or\n   the Management Activity API and streaming API subscriptions are active, and run a query that\n   returns events from each source for the last hour.\n4. Ask the SOC for the alert rule that detects a silent source and for the last coverage review.\n5. Fail if one of the four sources is not collected, if collection is delayed by more than a few\n   hours, or if no alert detects a source that stops.\n"
    },
    "remediation": {
      "manual": "1. Prepare the destination (Log Analytics workspace for Microsoft Sentinel, event hub for a\n   third-party SIEM).\n2. In the Microsoft Entra admin center as a Security Administrator, browse to **Entra ID** >\n   **Monitoring & health** > **Diagnostic settings** > **Add diagnostic setting**, select the log\n   categories listed above and the destination, and save.\n3. In the Microsoft Intune admin center as an Intune Administrator, browse to **Reports** >\n   **Diagnostic settings** > **Add diagnostic setting**, select `AuditLogs`, `OperationalLogs`,\n   `DeviceComplianceOrg` and `Devices`, and save.\n4. In the SIEM, enable the Microsoft 365 and Microsoft Defender XDR connectors (or subscribe to\n   the Office 365 Management Activity API content types `Audit.AzureActiveDirectory`,\n   `Audit.Exchange`, `Audit.SharePoint`, `Audit.General`, `DLP.All`, and configure the Defender\n   XDR streaming API).\n5. Create an alert rule for each source that raises an incident when no event arrives for a\n   defined period.\n",
      "rollback": "Delete the diagnostic setting or disable the connector.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Entra diagnostic settings for activity logs",
        "url": "https://learn.microsoft.com/entra/identity/monitoring-health/howto-configure-diagnostic-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Office 365 Management Activity API reference",
        "url": "https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft Defender XDR streaming API",
        "url": "https://learn.microsoft.com/defender-xdr/streaming-api",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Send Intune log data to Azure Monitor",
        "url": "https://learn.microsoft.com/intune/intune-service/fundamentals/review-logs-using-azure-monitor",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommandations de sécurité pour l'architecture d'un système de journalisation",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.4.1v1",
        "relation": "stricter",
        "note": "Covers Entra ID and also the unified audit log, Defender XDR and Intune, with monitoring of the collection chain."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R9",
        "relation": "partial",
        "note": "Centralization applied to Microsoft 365 sources."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R10",
        "relation": "related",
        "note": "Resilience of the collection service itself is the SIEM's responsibility; this control only requires monitoring that each source keeps sending."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R12",
        "relation": "partial",
        "note": "Coverage check limited to the Microsoft 365 sources listed."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R14",
        "relation": "partial",
        "note": "Near real-time forwarding through diagnostic settings and APIs, within Microsoft's own delivery delays."
      },
      {
        "framework": "anssi-admin",
        "framework_version": "3.0",
        "id": "R47",
        "relation": "partial",
        "note": "Applied to the Microsoft 365 administration events."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-4(1)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-6(3)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.008"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-001",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUDIT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-008",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-009",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-010",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-009",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-034",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}