Check ID:
Provider: Microsoft 365
Service:
Severity: CRITICAL
Categories:
Resource type:
purview_audit_log_search_enabledProvider: Microsoft 365
Service:
purviewSeverity: CRITICAL
Categories:
logging, e3Resource type:
NotDefinedWhat this check verifies
Microsoft Purview tenant setting for audit log search is assessed to confirm unified audit log ingestion (UnifiedAuditLogIngestionEnabled), which records user and admin activities and makes them searchable.
Risk
Without audit log ingestion/search, activity trails are missing or delayed, reducing visibility and accountability.- Data exfiltration and privilege abuse go undetected (confidentiality/integrity)
- Incident response and forensics fail due to absent evidence, increasing dwell time
Recommendation
Enable and keep audit log search on (UnifiedAuditLogIngestionEnabled=true). Apply least privilege to audit roles, set retention aligned to sensitivity, forward logs to a SIEM for defense in depth, and routinely review and alert on audit events. Avoid disabling auditing even when using third-party tools.
Remediation
- CLI
- Dashboard steps
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
References
- https://learn.microsoft.com/en-us/purview/audit-search?tabs=microsoft-purview-portal
- https://learn.microsoft.com/en-us/purview/audit-log-enable-disable
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = purview_audit_log_search_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks