# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-AUDIT-002
title: Forward Microsoft 365 security logs to the SIEM or SOC
finding:
  title: Microsoft 365 security logs are not collected by the security operations center
  description: Sign-ins, directory changes and workload audit events stay inside Microsoft 365, so the SOC cannot correlate them, alert on them in real time or keep them beyond native retention.
status: active
profiles: [baseline]
risk:
  severity: high
assessment: manual
tags: [audit, logging, siem, soc, sentinel, entra-id, defender, intune]

description: |
  The following logs are collected continuously, close to real time, by the organization's SIEM or
  SOC platform (Microsoft Sentinel or another product):

  - Microsoft Entra ID: sign-in logs (interactive, non-interactive, service principal, managed
    identity), audit logs, provisioning logs, risky users and risk detections, through **Diagnostic
    settings** to a Log Analytics workspace, an event hub or a partner solution;
  - Microsoft 365 unified audit log (Exchange, SharePoint, OneDrive, Teams, Power Platform,
    Copilot), through the Office 365 Management Activity API or the Microsoft 365 connector;
  - Microsoft Defender XDR incidents, alerts and advanced hunting events, through the streaming API
    or the Defender XDR connector;
  - Microsoft Intune audit and operational logs, through Intune **Diagnostic settings**.

  The collection chain is monitored: an alert is raised when a source stops sending events, and its
  coverage is reviewed at least once a year.
rationale: |
  Native consoles keep logs for a limited time and do not correlate Microsoft 365 events with
  on-premises, network and endpoint signals. Central collection lets the SOC detect an attack that
  starts with a phished account and continues on the network, keeps evidence out of reach of a
  tenant administrator who would tamper with it, and supports the retention requirements of
  CB-M365-AUDIT-003. Monitoring the chain detects a disabled export, a frequent attacker move.
impact: |
  Log Analytics, event hub or SIEM ingestion has a cost proportional to volume (non-interactive
  sign-ins and audit logs are large). Diagnostic settings require an Azure subscription.
notes: |
  Diagnostic settings and Management Activity API subscriptions are not exposed through Microsoft
  Graph: the evidence is a screenshot or export of the configuration and a query in the SIEM.

audit:
  manual: |
    1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a
       Security Reader and browse to **Entra ID** > **Monitoring & health** > **Diagnostic settings**.
       Check that a setting sends at least `AuditLogs`, `SignInLogs`, `NonInteractiveUserSignInLogs`,
       `ServicePrincipalSignInLogs`, `ManagedIdentitySignInLogs`, `ProvisioningLogs`, `RiskyUsers`
       and `UserRiskEvents` to the SIEM destination.
    2. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a
       Read Only Operator and browse to **Reports** > **Diagnostic settings**; check that
       `AuditLogs` and `OperationalLogs` are sent.
    3. In the SIEM, check that the Microsoft 365 (Office 365) and Microsoft Defender XDR connectors or
       the Management Activity API and streaming API subscriptions are active, and run a query that
       returns events from each source for the last hour.
    4. Ask the SOC for the alert rule that detects a silent source and for the last coverage review.
    5. Fail if one of the four sources is not collected, if collection is delayed by more than a few
       hours, or if no alert detects a source that stops.

remediation:
  manual: |
    1. Prepare the destination (Log Analytics workspace for Microsoft Sentinel, event hub for a
       third-party SIEM).
    2. In the Microsoft Entra admin center as a Security Administrator, browse to **Entra ID** >
       **Monitoring & health** > **Diagnostic settings** > **Add diagnostic setting**, select the log
       categories listed above and the destination, and save.
    3. In the Microsoft Intune admin center as an Intune Administrator, browse to **Reports** >
       **Diagnostic settings** > **Add diagnostic setting**, select `AuditLogs`, `OperationalLogs`,
       `DeviceComplianceOrg` and `Devices`, and save.
    4. In the SIEM, enable the Microsoft 365 and Microsoft Defender XDR connectors (or subscribe to
       the Office 365 Management Activity API content types `Audit.AzureActiveDirectory`,
       `Audit.Exchange`, `Audit.SharePoint`, `Audit.General`, `DLP.All`, and configure the Defender
       XDR streaming API).
    5. Create an alert rule for each source that raises an incident when no event arrives for a
       defined period.
  rollback: |
    Delete the diagnostic setting or disable the connector.

references:
  - title: Configure Microsoft Entra diagnostic settings for activity logs
    url: https://learn.microsoft.com/entra/identity/monitoring-health/howto-configure-diagnostic-settings
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Office 365 Management Activity API reference
    url: https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Microsoft Defender XDR streaming API
    url: https://learn.microsoft.com/defender-xdr/streaming-api
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Send Intune log data to Azure Monitor
    url: https://learn.microsoft.com/intune/intune-service/fundamentals/review-logs-using-azure-monitor
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Recommandations de sécurité pour l'architecture d'un système de journalisation
    url: https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-24
mappings:
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.AAD.4.1v1
    relation: stricter
    note: Covers Entra ID and also the unified audit log, Defender XDR and Intune, with monitoring of the collection chain.
  - framework: anssi-logging
    framework_version: "1.0"
    id: "R9"
    relation: partial
    note: Centralization applied to Microsoft 365 sources.
  - framework: anssi-logging
    framework_version: "1.0"
    id: "R10"
    relation: related
    note: Resilience of the collection service itself is the SIEM's responsibility; this control only requires monitoring that each source keeps sending.
  - framework: anssi-logging
    framework_version: "1.0"
    id: "R12"
    relation: partial
    note: Coverage check limited to the Microsoft 365 sources listed.
  - framework: anssi-logging
    framework_version: "1.0"
    id: "R14"
    relation: partial
    note: Near real-time forwarding through diagnostic settings and APIs, within Microsoft's own delivery delays.
  - framework: anssi-admin
    framework_version: "3.0"
    id: "R47"
    relation: partial
    note: Applied to the Microsoft 365 administration events.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-4(1)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-6(3)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-4
    relation: related
threats:
  - framework: mitre-attack
    id: T1562.008
related_controls:
  - id: CB-M365-AUDIT-001
    type: requires
  - id: CB-M365-AUDIT-003
    type: related
  - id: CB-M365-AUDIT-008
    type: related
  - id: CB-M365-AUDIT-009
    type: related
  - id: CB-M365-AUDIT-010
    type: related
  - id: CB-M365-ADMIN-009
    type: related
  - id: CB-M365-MAIL-034
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24