Microsoft 365 audit logging and alerting review
An audit logging and alerting review checks whether your Microsoft 365 tenant records user and admin activity, keeps those records long enough to investigate an incident, and sends alerts to people who can act on them. It covers the unified audit log, audit log retention, Microsoft Entra sign-in and audit logs, alert policies, and who receives notifications.
What Microsoft recommends for audit logging and alerts
Each recommendation below comes from Microsoft’s public documentation and is quoted from the page it cites. The review checks your tenant against each one, where your licensing and the agreed scope include it.
Verify that auditing is on when a Microsoft 365 organization is set up
What the review checks: Whether auditing is actually turned on, checked in Exchange Online where the agreed access allows, since Microsoft notes that UnifiedAuditLogIngestionEnabled always shows False in Security & Compliance PowerShell, and audit records showing when the status was changed and by whom.
“However, when you set up a new Microsoft 365 organization, verify the auditing status for your organization.”
Turn auditing on or off, Microsoft Learn Licensing: Microsoft’s Purview service description lists Audit (Standard) as included in Microsoft 365 E3, Office 365 E3 and E1, and Microsoft 365 Business plans, among others.
Don’t assume auditing is on for Business Basic, Business Standard, or Business Premium
What the review checks: For Business Basic, Business Standard, and Business Premium tenants, whether auditing was actually turned on, and who holds the Audit Logs role in Exchange Online that Microsoft requires to turn auditing on or off.
“Auditing isn't enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium.”
Turn auditing on or off, Microsoft Learn Licensing: Microsoft’s Purview service description lists Audit (Standard) as included in Business Basic, Business Standard, and Business Premium.
Route Microsoft Entra activity logs to a monitoring and analysis solution
What the review checks: Whether a Microsoft Entra diagnostic setting sends audit and sign-in logs to a Log Analytics workspace, event hub, or storage account, and whether the Microsoft Entra ID data connector is active in Microsoft Sentinel.
“Monitoring Microsoft Entra activity logs requires routing the log data to a monitoring and analysis solution.”
What is Microsoft Entra monitoring and health?, Microsoft Learn Licensing: Microsoft Entra keeps audit and sign-in logs for seven days on Microsoft Entra ID Free and 30 days on P1 and P2, and Microsoft states that a P1 or P2 license is required to ingest sign-in logs into Microsoft Sentinel.
With Audit (Premium), set audit log retention to meet security, IT, and compliance needs
What the review checks: Custom audit log retention policies, with their record types, users, duration, and priority, compared with your investigation and regulatory needs. Microsoft notes the dashboard does not show the default policy, and any custom policy takes priority over it, so a shorter one cuts retention.
“organizations using Audit (Premium) can create audit log retention policies to meet the requirements of your organization's security operations, IT, and compliance teams”
Get started with auditing solutions, Microsoft Learn Licensing: Microsoft states that keeping a user’s audit records beyond 180 days, up to one year, needs Office 365 E5, Microsoft 365 E5, Microsoft Purview Suite, or the E5 eDiscovery and Audit add-on, and also lists Audit (Premium) in Purview Suite for Business Premium add-ons.
Where long-term storage is required, archive Microsoft Entra activity logs
What the review checks: Whether a diagnostic setting archives audit and sign-in logs to a storage account, and how retention is managed on that storage account, since Microsoft has deprecated the diagnostic settings storage retention feature.
“We recommend setting up a storage account to archive your activity logs for those governance and compliance scenarios where long-term storage is required.”
How to access activity logs in Microsoft Entra ID, Microsoft Learn Assign investigators a role that lets them search and export the audit log
What the review checks: Membership of the Audit Manager and Audit Reader role groups in the Microsoft Purview portal, any other role group or Exchange admin center assignment holding the Audit Logs or View-Only Audit Logs role, and who can read Microsoft Entra activity logs.
“Admins and members of investigation teams must be assigned the View-Only Audit Logs or Audit Logs role in the Microsoft Purview portal to search or export the audit log.”
Get started with auditing solutions, Microsoft Learn Consider email notifications for alert policies by category or higher severity
What the review checks: Status, severity, category, email recipients, and daily notification limit of default and custom alert policies in the Microsoft Defender portal. Microsoft notes a new or edited policy can take up to 24 hours before it triggers alerts.
“Consider enabling email notifications for alert policies of a specific category or that have a higher severity setting.”
Alert policies in the Microsoft Defender portal, Microsoft Learn Licensing: Microsoft states that threshold and unusual-activity alert policies need E5/G5, or E1/F1/G1 or E3/F3/G3 with a qualifying add-on, and that E1/F1/G1 and E3/F3/G3 organizations without one can only create policies that alert every time an activity occurs.
Alert on all sign-in and audit log activity for emergency access accounts
What the review checks: Whether Microsoft Entra sign-in logs reach a Log Analytics workspace with an alert rule on SigninLogs for the emergency access accounts’ object IDs that notifies administrators, or an equivalent Microsoft Sentinel rule, and whether their audit log activity is also alerted on.
“Monitor all sign-in and audit log activity for emergency access accounts with alerts to detect unnecessary or unauthorized use.”
Manage emergency access accounts in Microsoft Entra ID, Microsoft Learn Test that Microsoft Defender XDR incident emails reach their recipients
What the review checks: Whether incident email notification rules exist in the Microsoft Defender XDR settings, which alert severities and device groups they cover, and whether the recipients are current, monitored addresses.
“To test notifications and ensure that the recipients receive them in the inboxes, select Send test email.”
Get incident notifications by email in Microsoft Defender XDR, Microsoft Learn
What the review covers
The review reads the settings that decide whether activity is recorded, kept long enough to investigate, and seen by someone who can act on it. Coverage depends on your licensing, including which Microsoft Defender products you have, and the agreed scope. Where Microsoft Entra logs are sent to Azure resources, such as a Log Analytics workspace or a storage account, reviewing them depends on the access agreed during scoping.
Part of the audit's logging and monitoring area.
- Unified audit log status
- Whether auditing is on, confirmed rather than assumed, including on Business plans where Microsoft says it isn’t on by default.
- Audit log retention
- How long audit records are kept for each group of users, given their licenses and any custom retention policies, compared with how far back your organization needs to investigate.
- Microsoft Entra sign-in and audit logs
- Where Microsoft Entra sign-in and audit logs are sent so they are kept longer than Microsoft Entra’s own retention, seven days on Microsoft Entra ID Free and 30 days on P1 and P2, and how long they are kept there.
- Access for investigators
- Who can search and export the audit log and read Microsoft Entra activity logs, and whether the people expected to investigate an incident hold those roles.
- Alert policies and recipients
- Status, severity, and email recipients of default and custom alert policies, and the daily notification limit that stops further emails for an alert that day.
- Incident notifications
- Microsoft Defender XDR incident email rules, the alert severities and device groups they cover, and whether recipients are current, monitored addresses.
- Emergency access account alerts
- Whether sign-in and audit activity on emergency access accounts raises an alert that reaches an administrator.
When teams ask for it
- Before an investigation depends on it
- Confirm that audit and sign-in records exist, and reach back far enough, before a security incident or an HR, legal, or compliance request needs them.
- When a search came back short
- A search for past activity returned less history than expected, and the team wants to know why and what to change before the next one.
- When alerts reach no one
- Alerts appear in the portal but no email arrives, or nobody is sure who receives them or who is expected to respond.
- On Microsoft 365 Business plans
- In Business Basic, Business Standard, and Business Premium tenants, where Microsoft says auditing isn’t on by default and no one has confirmed it was turned on.
- Answering a security questionnaire
- A customer questionnaire or internal review asks how long activity records are kept, who receives alerts, and how that can be shown.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
What does the audit logging and alerting review cover?
It covers whether the unified audit log is on, how long audit records and Microsoft Entra sign-in and audit logs are kept, who can search them, and which alerts are set up and who receives them.
It is a configuration review within the Microsoft 365 tenant audit, not a penetration test or a compliance certification. The areas included in your engagement are agreed during scoping.
It also differs from Microsoft Secure Score, which measures your security posture against Microsoft’s recommended actions. This review adds business context, backs each finding with evidence, and sequences the remediation.
Is audit logging available on Microsoft 365 Business plans?
Yes. Microsoft’s Purview service description lists Audit (Standard) as included in Business Basic, Business Standard, and Business Premium.
Microsoft also states that auditing isn’t on by default for those licenses, so the review checks whether it has been turned on in your tenant.
Microsoft states that audit records for users without an E5 license or a qualifying add-on, and for guest users, are kept for 180 days. Longer retention depends on additional licensing, such as Audit (Premium), which the Purview service description also lists in Purview Suite for Business Premium add-ons. Findings state where a recommendation depends on a license you may not have.
How far back can we see Microsoft Entra sign-in and audit logs?
Microsoft Entra keeps audit and sign-in logs for seven days on Microsoft Entra ID Free and 30 days on P1 and P2. Microsoft notes that retention changes aren’t retroactive: after an upgrade from Microsoft Entra ID Free to P1 or P2, only data still within the Microsoft Entra ID Free retention period is available, and expired data can’t be recovered unless it was previously archived.
Microsoft notes that these logs are separate from the Microsoft 365 unified audit log, whose retention is managed through Microsoft Purview Audit. It recommends archiving them to a storage account where long-term storage is required, and notes that organizations with Microsoft 365 E5, Office 365 E5, Microsoft Purview Suite, or the E5 eDiscovery and Audit add-on can also use Audit (Premium) to keep Microsoft Entra ID audit logs beyond the default period.
The review checks which of these is in place and compares it with how far back you need to investigate.
Alerts appear in the portal, so why are we not receiving the emails?
Seeing an alert in the portal does not mean an email is sent. Each alert policy in the Microsoft Defender portal has its own email notification setting, recipient list, and daily notification limit, after which no more notifications are sent for that alert that day.
Microsoft Defender XDR incident emails are set up separately, as notification rules based on alert severity, alert source, and device group. The review checks both, and whether the recipients are current, monitored addresses.
What access does the review need, and will it change our settings?
Access is agreed during scoping. It follows least privilege and is time-bound, and read-oriented roles are preferred wherever the assessment method allows.
The review does not change settings without your agreement. If auditing is off or an alert reaches no one, that is reported as a finding with a recommended action. Whether the engagement includes any remediation, and who carries it out, is agreed during scoping.
How is the cost determined?
Cost follows the scope agreed for your Microsoft 365 tenant audit. Scope comes first, and timing and pricing follow from it. They depend on the size and complexity of your tenant, the control areas included, and the deliverables you need.
Scope, timing, and pricing are confirmed in writing before the engagement starts.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit