Restrict who can read, disable or shorten Microsoft 365 audit logs

Description

Access to Microsoft 365 audit data and settings is limited to named people with an operational need, reviewed at least every six months:

• Write: the roles that can turn the unified audit log or mailbox auditing off, create or delete audit retention policies, or change diagnostic settings (Audit Logs role, Organization Configuration role, Organization Management and Compliance Administrator role groups, Security Administrator for Entra diagnostic settings) are held only by the administrators who manage logging, preferably eligible through PIM;
• Read: the View-Only Audit Logs and Audit Logs roles, Security Reader and Reports Reader are held only by the security, SOC and investigation teams;
• the SIEM copy of the logs (CB-M365-AUDIT-002) has its own access control that tenant administrators cannot change alone.

Rationale

An attacker with administrator rights commonly tries to disable logging or shorten retention before acting. Limiting write access, and keeping an independent copy, preserves the evidence. Audit logs also contain personal data (who read which mail, who opened which file); the GDPR principle of data minimization applies to their readers as much as to their content.

Impact

Administrators who used audit search for troubleshooting must request access or go through the security team.

Audit

1. In the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader, browse to Settings > Roles and scopes > Role groups and list the members of role groups that contain Audit Logs, View-Only Audit Logs or Organization Configuration.
2. In Exchange Online PowerShell (View-Only Organization Management), list who holds the Audit Logs role: Get-ManagementRoleAssignment -Role "Audit Logs" -GetEffectiveUsers | Select-Object EffectiveUserName,RoleAssigneeName and the same for View-Only Audit Logs; list members of Organization Management with Get-RoleGroupMember "Organization Management".
3. In the Microsoft Entra admin center, browse to Entra ID > Roles & admins and list the members of Global Administrator, Security Administrator, Compliance Administrator, Security Reader and Reports Reader.
4. Compare with the list of people approved for logging administration and investigation.
5. Fail if accounts outside the approved list hold these roles, or if no review has taken place in the last six months.

Remediation

1. Define and approve the list of people who administer logging and those who investigate.
2. Remove other members from the Purview and Exchange role groups (Settings > Roles and scopes > Role groups, or Remove-RoleGroupMember) and from the Entra roles.
3. Where possible, create a dedicated role group with only View-Only Audit Logs for investigators, and move write roles to PIM-eligible assignments.
4. Alert on changes to audit settings (Set-AdminAuditLogConfig, Set-OrganizationConfig -AuditDisabled, New/Set/Remove-UnifiedAuditLogRetentionPolicy, diagnostic setting changes) in the SIEM.
5. Role required: Organization Management (Exchange, Purview role groups) and Privileged Role Administrator (Entra roles).

Rollback

Add the removed member back to the role group.

References

• Permissions in the Microsoft Purview portal Microsoft, vendor-doc, accessed 2026-10-24
• Search the audit log Microsoft, vendor-doc, accessed 2026-10-24
• Get-ManagementRoleAssignment Microsoft, vendor-doc, accessed 2026-10-24
• Recommandations de sécurité pour l'architecture d'un système de journalisation ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUDIT-001 Turn on the unified audit log
• related CB-M365-AUDIT-003 Retain Microsoft 365 audit logs long enough for investigations
• related CB-M365-ADMIN-006 Grant highly privileged roles just in time through Privileged Identity Management

People and lifecycle