Using the Microsoft 365 audit log in an investigation

Microsoft says audit logging is on by default for Microsoft 365 organizations, with an important exception: it isn't enabled by default for small and medium business licences, including Microsoft 365 Business Basic, Business Standard and Business Premium, or for unmanaged tenants on free enterprise trials. Those organizations must turn it on manually. Many small businesses have never checked, which means the first time anyone looks is after an incident.

To check, connect to Exchange Online PowerShell and run:

• Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
• True means auditing is on. Microsoft warns to run this in Exchange Online PowerShell, not Security & Compliance PowerShell, where the property always shows False.
• If it's off, turn it on in the Microsoft Purview portal (Audit shows a banner prompting you to start recording) or run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. Microsoft says events can take several hours to become searchable after you turn it on.

Premium requires higher-tier licensing; check what your plan includes. The table below is from Microsoft's auditing solutions overview. If you're on Standard, 180 days is your investigation window.

Fraud is often discovered months after the first access. If a longer history matters, export logs to a SIEM or storage through the Office 365 Management Activity API.

You need the Audit Logs or View-Only Audit Logs role. In the Purview portal, Audit search runs as a search job; Microsoft says each user can run up to 10 search jobs at once and completed jobs are kept for 30 days. In PowerShell, Search-UnifiedAuditLog does the same work. The operation names below are as listed in Microsoft's audit log activities reference; a misspelled name returns an empty result rather than an error.

1. 01

   Export everything relevant to CSV

   From the search job you can export all items. Keep the raw export untouched; work on a copy.

2. 02

   Record how you searched

   Note the search criteria, who ran it, when, and the time zone. Audit timestamps are in UTC; convert to Eastern (or local) time only in your working copy, and label it.

3. 03

   Hash and store the export

   Calculate a hash value of each export file and store it somewhere access-controlled. If the matter goes to an insurer, a regulator or court, you'll need to show the data wasn't altered.

4. 04

   Export before the window closes

   With 180-day retention, older evidence ages out every day. Preserve early.

5. 05

   Don't rely on one source

   Pair audit results with Entra sign-in logs (kept 7 or 30 days depending on licence) and message trace, which have their own shorter windows.

• Mailbox auditing is on by default in all organizations and logs a predefined set of actions for three sign-in types: Owner, Delegate and Admin. Check with Get-OrganizationConfig | Format-List AuditDisabled; False means it's on.
• Default actions include MailItemsAccessed (mail accessed by protocols and clients), Send, SendAs, SendOnBehalf and others. Some actions, such as SearchQueryInitiated, depend on licence and aren't on for every sign-in type by default.
• Mailbox audit bypass can exclude accounts from logging. Check that no user accounts have it, since a compromised admin could set it.
• If mailbox audit actions were customized in the past, those custom settings persist; Get-Mailbox ... | Format-List DefaultAuditSet shows whether Microsoft's defaults apply.

• Lag: Microsoft notes audit entries can take from 30 minutes to 24 hours to appear.
• Coverage: not every action in every service is audited, and some events depend on licence.
• Retention: once records age out, they're gone. Microsoft can't restore them.
• Context: the log shows that an item was accessed or a rule created, not why. Interpreting it alongside sign-in data, message headers and interviews is where an investigation is won or lost.
• Integrity: the log itself is reliable, but an attacker with admin rights can change audit configuration. Look for those changes too.

• Turn auditing on or off, Microsoft Learn
• Auditing solutions in Microsoft Purview, Microsoft Learn
• Search the audit log, Microsoft Learn
• Audit log activities, Microsoft Learn
• Manage mailbox auditing, Microsoft Learn
• App consent grant investigation, Microsoft security playbook
• Microsoft Entra data retention, Microsoft Learn