The Microsoft 365 unified audit log: verify it, search it, keep it
Who read this mailbox, shared this file or created this forwarding rule? In Microsoft 365, the answer lives in the unified audit log, provided it is enabled, the retention period is long enough and you know how to query it.
Check that auditing is enabled
Auditing is on by default for most organisations, but older tenants and past deactivations do exist. Check it in Exchange Online PowerShell:
Connect-ExchangeOnline Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
The value must be True. Also check that mailbox auditing has not been bypassed with AuditBypassEnabled on some accounts, and that default mailbox auditing has not been turned off at organisation level.
Retention depends on licensing
With Audit (Standard), records are kept for 180 days according to current documentation; Microsoft has extended this period in the past. Audit (Premium), included in E5-type licences or available as an add-on, keeps some records (Exchange, SharePoint, Entra ID) for one year by default and lets you define audit retention policies, up to ten years with an add-on. Durations and scope vary by workload and licence, so check the current documentation rather than assuming.
Searching the log
Two main interfaces:
- the Microsoft Purview portal (Audit): search by date range, user, activity or file, run as a background job and exportable to CSV;
- Search-UnifiedAuditLog in PowerShell, handy for automation but subject to per-query result limits, so you need to page through results with
SessionIdandSessionCommand ReturnLargeSet.
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) ` -Operations New-InboxRule,Set-InboxRule -ResultSize 5000
An audit log query API is also available through Microsoft Graph; check its status and required permissions before building it into your tooling.
MailItemsAccessed, the key event in investigations
The MailItemsAccessed event records access to messages, whether through client synchronisation or individual reads. It is what lets you estimate which emails an attacker may have seen. Long reserved for Audit (Premium), it was extended to more customers from 2024 onwards; check that it is present in the audited actions of your mailboxes, because an old custom configuration may exclude it.
Key point. In a mailbox compromise, the absence of MailItemsAccessed often forces you to assume the whole mailbox was read, with the consequences that follow for data breach notification.
Export for longer retention
If native retention does not meet your needs, export the events. The Microsoft 365 connector in Microsoft Sentinel, the Office 365 Management Activity API or a third-party SIEM let you keep logs according to your own policy. Set up the export before you need it: as with Entra ID logs, it is not retroactive.
What an audit checks
- unified audit log ingestion is enabled;
- no mailbox has auditing bypassed;
- MailItemsAccessed is included in audited actions;
- a retention period, native or exported, consistent with internal policy.