What audit logging should we turn on in Microsoft 365?

Key facts

• The unified audit log is on by default in most tenants, but it should be verified, not assumed.
• Audit (Standard) keeps most records for 180 days; Audit (Premium) keeps them for one year by default.
• Entra sign-in logs are kept for a short window unless you export them.
• Logs only help if someone reviews alerts and can search them during an incident.
• Keep logs outside the tenant so an attacker with admin rights cannot quietly erase the trail.

The logs that matter

Microsoft 365 logging is spread across several places. For investigations, the most important are the unified audit log in Microsoft Purview, mailbox audit records in Exchange Online, and the sign-in and audit logs in Microsoft Entra ID. Device and endpoint events live in Microsoft Intune and Microsoft Defender for Endpoint.

Check what is actually turned on

Verify the unified audit log in the Purview portal or with Get-AdminAuditLogConfig in Exchange Online PowerShell. Mailbox auditing is on by default for user mailboxes, but check that no mailboxes have auditing bypassed and that default audited actions have not been trimmed.

For SharePoint and OneDrive, check that file access and sharing events appear in search results. For Teams, confirm chat and meeting events show up. A quick test is to make a known change, wait, and then search for it.

How long logs are kept

Retention depends on licensing and on the log. Audit (Standard), included in most business and enterprise plans, keeps audit records for 180 days. Audit (Premium), part of Microsoft 365 E5 and E5 Compliance, keeps Exchange, SharePoint and Entra records for one year by default, supports custom audit log retention policies, and offers longer retention as an add-on.

Entra sign-in and audit logs have a much shorter built-in window, longer with Entra ID P1 or P2 than without, but still not long enough for most investigations. Configure Entra diagnostic settings to send them to a Log Analytics workspace, an Azure storage account or Microsoft Sentinel.

Set retention by need, not by default

Decide retention from how incidents are discovered and what your compliance program requires. Business email compromise is often found weeks or months later, so short retention can leave you blind. Your legal counsel, insurer or assessor may set minimums for your industry.

• Sign-in logs: long enough to trace a compromise back to its start, often a year or more.
• Admin and directory changes: long enough to cover your audit cycle.
• Mailbox access: long enough to answer which messages an attacker read.
• Cost control: send high-volume, low-value logs to cheaper storage tiers rather than dropping them.

Make the logs useful

Logs that nobody reads only help after the fact. Turn on alert policies in Purview and Defender for risky events: new inbox forwarding rules, mass downloads, new admin role assignments, and sign-ins to emergency access accounts. Route alerts to a monitored mailbox or ticket queue with a named owner.

Document how to run a search, who has the Audit Reader or Audit Manager role, and where exported logs live. Practice a search during a calm week so it is not the first time during an incident.

How Accred Consulting approaches it

Accred Consulting reviews and sets up Microsoft 365 logging as part of security and compliance projects. Discovery confirms licensing, current settings and what your compliance program and insurer expect. The proposal sets a clear scope, fixed price and timeline. US-based specialists verify the unified audit log and mailbox auditing, configure Entra diagnostic settings to Log Analytics or Microsoft Sentinel, set retention policies where licensed, and build alert policies with clear owners. Accred configures controls that support your compliance program; you and your assessor own compliance. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions