Microsoft 365 Audit Logging [CHK-1002]
This check verifies if user and administrator actions in the Microsoft 365 tenant are being logged.
Rationale
Enabling Microsoft 365 audit logs ensures that all user and admin activities are recorded. This is crucial for maintaining security and compliance within your organization.
Fix
An automated fix is available through Attic.
Manual steps:
-
Sign into the Microsoft Purview portal.
-
Select the Audit solution card. If the Audit solution card isn't displayed, select View all solutions and then select Audit from the Core section.
-
If auditing isn't turned on for your organization, a banner is displayed prompting you start recording user and admin activity.
-
Select the Start recording user and admin activity banner.
Impact
Enabling Microsoft 365 audit logs will ensure all user and admin activities are recorded, providing a comprehensive audit trail for your organization.
More Information
For more details, refer to the official Microsoft 365 Audit Log documentation.