Control: 3.1.1 Ensure Microsoft 365 audit log search is Enabled

Description

When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 90 days. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a global admin can choose to turn off audit log search in Microsoft 365.

Enabling audit log search in the Microsoft Purview compliance portal can help organizations improve their security posture, meet regulatory compliance requirements, respond to security incidents, and gain valuable operational insights.

Remediation

To enable Microsoft 365 audit log search:

1. Navigate to Microsoft Purview https://compliance.microsoft.com.
2. Select Audit to open the audit search.
3. Click Start recording user and admin activity next to the information warning at the top.
4. Click Yes on the dialog box to confirm.

To enable Microsoft 365 audit log search using PowerShell:

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following PowerShell command:

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true