What this check looks at
Checks, from Microsoft Secure Score, that the unified audit log is recording activity across Microsoft 365.
The unified audit log in Microsoft Purview records user and administrator activity across Microsoft 365: mailbox actions, file access and sharing in SharePoint and OneDrive, Teams activity, administrator changes and much more. It is what you search when something goes wrong. It is on by default, but it can be switched off (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false), and some older tenants never had it switched on.
The check reads UnifiedAuditLogIngestionEnabled directly from Exchange Online where it can: on passes and off fails, whatever Secure Score says. Where Exchange Online was not read, it uses Microsoft Secure Score’s audit log actions and fails when any is not done. It reports not checked when neither source is available.
With it off, nothing is recorded from that moment, and activity cannot be recovered afterwards. An attacker with administrator rights sometimes switches it off precisely to hide what they do next. Investigating a compromised mailbox, a mass download or a sharing leak then becomes guesswork.
Why it matters
The audit log is the record of who signed in, read, shared, forwarded and deleted what. With it off, an incident cannot be investigated and a breach cannot be scoped, which insurers and regulators treat as a failure in its own right.
A typical case: a client of a 30-person accountancy firm pays £48,000 to a fraudster after an email from a partner’s real mailbox. The insurer’s incident responders ask for the audit log to see when the attacker got in, which mailboxes and files they reached and whether client data was downloaded. With auditing off, none of that can be answered, so the firm has to assume the worst and notify every client whose data was in reach, and the ICO.
Insurers and regulators treat having no audit trail as a failing in its own right: it turns a contained incident into an unbounded one, and it makes every later claim harder to support.
CIS Microsoft 365 Foundations Benchmark 3.1.1 and CISA SCuBA MS.DEFENDER.6.1v1 ask for audit log search to be enabled. It is ISO 27001 A.8.15 (logging), PCI DSS 10.2.1 and the NCSC Cyber Assessment Framework’s C1.a and C1.b. Auditing is included in every Microsoft 365 business and enterprise plan.
How to fix it
Where: Microsoft Purview portal → Audit
Before you start
- Nothing needed; auditing is included in every Microsoft 365 business plan.
Step by step
- Check the current setting. In Exchange Online PowerShell (Install-Module ExchangeOnlineManagement, then Connect-ExchangeOnline as an Exchange Administrator), run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled.
- Turn on recording in the Purview portal. In the Microsoft Purview portal, go to Solutions > Audit. If a banner offers "Start recording user and admin activity", select it.
- Or turn it on in PowerShell. Run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. If the command says the organisation must be customised first, run Enable-OrganizationCustomization, wait for it to finish, and run the command again.
- Treat an unexplained switch-off as a warning sign. If auditing had been on and someone turned it off, find out who and why. If nobody can explain it, treat it as a possible compromise: review who holds admin roles, their recent sign-ins in the Entra sign-in logs, and any new app registrations or mail forwarding.
- Confirm the change. It can take up to an hour for recording to start. Then Get-AdminAuditLogConfig shows UnifiedAuditLogIngestionEnabled True, the banner is gone from Purview > Audit, and a search for the last 24 hours (Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -ResultSize 10) returns recent activity.
With PowerShell
Connect-ExchangeOnline Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
What users will notice
None.
How to confirm it worked
Microsoft Purview, Audit: searches return recent activity, with no banner asking to start recording.
Frameworks and controls
This check maps to controls in 17 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.a Monitoring coverageC1.b Securing logs |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-3 Enable logging for security investigation |
| Zero Trust | Visibility, automation and orchestration |
| Secure Score | Turn on audit log search |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| PCI DSS 4.0.1 | 10.2.1 Audit logs are enabled and active |
| NIST SP 800-171 | 3.3.1 Create and retain system audit logs and records3.3.2 Ensure the actions of individual users can be traced |
| CMMC Level 2 | AU.L2-3.3.1 System AuditingAU.L2-3.3.2 User Accountability |
| ISO 27001:2022 | A.8.15 Logging |
| CISA SCuBA | MS.DEFENDER.6.1v1 Unified audit logging enabled |
| CIS M365 | 3.1.1 Ensure Microsoft 365 audit log search is enabled |
| CIS Controls v8.1 | 8.2 Collect audit logs (IG1) |
| NIST CSF 2.0 | DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events |
| NCSC 10 Steps | Logging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Turn auditing on or off (Microsoft Learn)