Microsoft 365 audit: logging

The unified audit log

The unified audit log centralizes activity from Exchange, SharePoint, OneDrive, Teams and Entra ID. It is on by default in new tenants, but we still sometimes find it turned off. Two checks in Exchange Online PowerShell:

Connect-ExchangeOnline -ShowBanner:$false

# Unified audit log: should return True
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# Mailbox auditing: should return False (auditing not disabled)
Get-OrganizationConfig | Select-Object AuditDisabled

Making sure events are arriving

An enabled setting does not guarantee events are actually recorded. A search over the last 24 hours confirms it:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 10 |
  Select-Object CreationDate, UserIds, Operations

No results in an active tenant deserve a closer look: a recently enabled log, insufficient permissions or disabled ingestion.

How long logs are kept

Default retention is often shorter than people think, and incidents are often discovered weeks after the intrusion began:

• Audit log (Audit Standard): 180 days.
• Audit Premium (E5 or add-on licences): one year by default, extendable.
• Entra ID sign-in logs: 7 days without P1, 30 days with P1 or P2.

To go further, we recommend exporting logs to a Log Analytics workspace or a SIEM, with retention that matches your obligations.

A signal to check: forwarding rules

After compromising a mailbox, attackers often create a rule that quietly forwards email outside the organization. This command lists inbox rules that forward or redirect messages:

Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    Get-InboxRule -Mailbox $_.UserPrincipalName |
      Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo }
} | Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo

In a large tenant this command can take a while: start with privileged accounts and sensitive roles (finance, management). Any forwarding rule to an unknown external address should be confirmed with the user.

What next?

This series covers the checks we consider top priority. A full audit adds external sharing, third-party applications and, where relevant, the Azure environment.

Would you rather we handle it? See our Microsoft 365 and Azure security service or get in touch.