Microsoft 365 Audit Logging

Microsoft 365 Audit Logging

For whatever reason the default fresh setup of Microsoft 365 has no audit logging turned on. Audit logging is very useful for IT troubleshooting and auditors love logs.

Microsoft says that it is enabled by default for Microsoft 365 and Office 365 enterprise organizations. I suspect that means only if you have E1 or higher. The new tenants I’ve made recently are not E1 or higher, that could be why I didn’t see it already on.

Someone asked for clarification about this on GitHub however the replies all say that it is on by default for everything but that isn’t true based on my experience. You can read the GitHub issue here.

Microsoft’s documentation also says to double check that audit logging is enabled which you 100% should be doing as if it’s on or not seems inconcistant.

In this post I will detail how to check if audit logging is enabled and how to enable it via the Web UI or PowerShell.

Prerequisites

The Web UI Way

If audit logging isn’t enable the page will look something like this.

Audit Logging is now enabled it may take a bit for it to actually start working.

The PowerShell Way

In my example the returned result is false so audit logging isn’t enabled and we want to turn that on.

The process can take up to 60 minutes.

In my example the returned result is now true so audit logging is now enabled.

Summary

That’s all it take to enable Audit Logging on Microsoft 365.

If you want to read more about the audit log you can do so by reading Microsoft’s documentation about it here.

Exit mobile version