{
  "id": "CB-M365-AUDIT-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-012.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-012",
    "title": "Restrict who can read, disable or shorten Microsoft 365 audit logs",
    "finding": {
      "title": "Too many accounts can read audit logs or change their recording and retention",
      "description": "Audit logs reveal what every user did and are the evidence of an intrusion; broad read access exposes personal data, and broad write access lets an attacker erase their tracks."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "audit",
      "logging",
      "least-privilege",
      "purview",
      "rbac"
    ],
    "description": "Access to Microsoft 365 audit data and settings is limited to named people with an operational\nneed, reviewed at least every six months:\n\n- **Write**: the roles that can turn the unified audit log or mailbox auditing off, create or\n  delete audit retention policies, or change diagnostic settings (Audit Logs role, Organization\n  Configuration role, Organization Management and Compliance Administrator role groups, Security\n  Administrator for Entra diagnostic settings) are held only by the administrators who manage\n  logging, preferably eligible through PIM;\n- **Read**: the View-Only Audit Logs and Audit Logs roles, Security Reader and Reports Reader are\n  held only by the security, SOC and investigation teams;\n- the SIEM copy of the logs (CB-M365-AUDIT-002) has its own access control that tenant\n  administrators cannot change alone.\n",
    "rationale": "An attacker with administrator rights commonly tries to disable logging or shorten retention\nbefore acting. Limiting write access, and keeping an independent copy, preserves the evidence.\nAudit logs also contain personal data (who read which mail, who opened which file); the GDPR\nprinciple of data minimization applies to their readers as much as to their content.\n",
    "impact": "Administrators who used audit search for troubleshooting must request access or go through the\nsecurity team.\n",
    "audit": {
      "manual": "1. In the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader,\n   browse to **Settings** > **Roles and scopes** > **Role groups** and list the members of role\n   groups that contain **Audit Logs**, **View-Only Audit Logs** or **Organization\n   Configuration**.\n2. In Exchange Online PowerShell (View-Only Organization Management), list who holds the Audit\n   Logs role: `Get-ManagementRoleAssignment -Role \"Audit Logs\" -GetEffectiveUsers | Select-Object EffectiveUserName,RoleAssigneeName`\n   and the same for `View-Only Audit Logs`; list members of Organization Management with\n   `Get-RoleGroupMember \"Organization Management\"`.\n3. In the Microsoft Entra admin center, browse to **Entra ID** > **Roles & admins** and list the\n   members of Global Administrator, Security Administrator, Compliance Administrator, Security\n   Reader and Reports Reader.\n4. Compare with the list of people approved for logging administration and investigation.\n5. Fail if accounts outside the approved list hold these roles, or if no review has taken place\n   in the last six months.\n"
    },
    "remediation": {
      "manual": "1. Define and approve the list of people who administer logging and those who investigate.\n2. Remove other members from the Purview and Exchange role groups (**Settings** > **Roles and\n   scopes** > **Role groups**, or `Remove-RoleGroupMember`) and from the Entra roles.\n3. Where possible, create a dedicated role group with only **View-Only Audit Logs** for\n   investigators, and move write roles to PIM-eligible assignments.\n4. Alert on changes to audit settings (`Set-AdminAuditLogConfig`, `Set-OrganizationConfig\n   -AuditDisabled`, `New/Set/Remove-UnifiedAuditLogRetentionPolicy`, diagnostic setting changes)\n   in the SIEM.\n5. Role required: Organization Management (Exchange, Purview role groups) and Privileged Role\n   Administrator (Entra roles).\n",
      "rollback": "Add the removed member back to the role group.\n"
    },
    "references": [
      {
        "title": "Permissions in the Microsoft Purview portal",
        "url": "https://learn.microsoft.com/purview/purview-permissions",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Search the audit log",
        "url": "https://learn.microsoft.com/purview/audit-search",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Get-ManagementRoleAssignment",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/get-managementroleassignment",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Recommandations de sécurité pour l'architecture d'un système de journalisation",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/anssi-guide-recommandations_securite_architecture_systeme_journalisation.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R26",
        "relation": "partial",
        "note": "In Microsoft 365, write access means the ability to disable recording or change retention; logs cannot be edited directly."
      },
      {
        "framework": "anssi-logging",
        "framework_version": "1.0",
        "id": "R27",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-9",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-9(4)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.008"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-001",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-003",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}