Get started with auditing solutions
Microsoft Purview Audit (Standard) and Audit (Premium) allow you to search for audit records for activities performed in the different Microsoft services by users and admins. Because Audit (Standard) is enabled by default for most Microsoft 365 organizations, there are only a few things you need to do before you, and others in your organization can search the audit log. There are a few more configuration steps you'll need to complete to use features only available in Audit (Premium).
For more information about Audit (Standard) and Audit (Premium) capabilities, see Microsoft Purview auditing solutions.
Tip
If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs. Start now at the Microsoft Purview trials hub. Learn details about signing up and trial terms.
Step 1: Verify organization subscription and user licensing
Licensing for Audit (Standard) and Audit (Premium) requires the appropriate organization subscription that provides access to audit log search tool and per-user licensing that's required to log and retain audit records.
When an audited activity is performed by a user or admin, an audit record is generated and stored in the audit log for your organization. In Audit (Standard) and Audit (Premium), audit records are retained and searchable in the audit log for 180 days.
Important
The default retention period for Audit (Standard) has changed from 90 days to 180 days. Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.
For a list of subscription and licensing requirements for these auditing solutions, see the subscription requirements for Audit (Standard) and Audit (Premium).
Step 2: Assign permissions to search the audit log
Admins and members of investigation teams must be assigned the View-Only Audit Logs or Audit Logs role in the Microsoft Purview portal or the Microsoft Purview compliance portal to search or export the audit log. By default, these roles are assigned to the Audit Reader and Audit Manager role groups on Role groups page in the Microsoft Purview portal and the Permissions page in the compliance portal.
Note
Access to enable or disable auditing and access to audit cmdlets currently requires permissions from the Exchange admin center. Use the existing Audit Logs and View-Only Audit Logs roles in the Exchange admin center to grant access to audit cmdlets. Use the existing Audit Logs role in the Exchange admin center to grant access to enable or disable auditing.
You can also create custom role groups with the ability to search the audit log by adding the View-Only Audit Logs or Audit Logs roles to a custom role group. For more information, see Permissions in the Microsoft Purview compliance portal.
Note
Access to the Audit Search Graph API requires additional permissions to be configured in Microsoft Graph. For more information, see Permissions in Audit Search Graph API.
Assign permissions to scope audit logs
To search or export the audit log, administrators or members of investigation teams must be assigned to at least one of the following audit-related role groups in the Microsoft Purview portal or the compliance portal:
- Audit Manager: A user assigned to the Audit Manager role group can search and export the audit log and manage audit settings for the tenant (like enabling or disabling audit logging). This role group grants the View-Only Audit Logs and Audit Logs roles to the user.
- Audit Reader: A user assigned to the Audit Reader role group can only search and export the audit log. They can't enable or disable audit logging. This role group grants the View-Only Audit Logs role to the user.
Step 3: Enable SearchQueryInitiated events
You must explicitly enable two events (SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint) for logging when users perform searches in Exchange Online and SharePoint.
To enable these two events to be audited for users, run the following cmdlet (for each user) in Exchange Online PowerShell:
Set-Mailbox <user> -AuditOwner @{Add="SearchQueryInitiated"}
In a multi-geo environment, you must run the Set-Mailbox command in the forest where the user's mailbox is located. To identify the user's mailbox location, run the following cmdlet:
Get-Mailbox <user identity> | FL MailboxLocations
If the cmdlet to enable auditing of search queries was previously run in a forest that's different than the forest the user's mailbox is located in, you must remove the SearchQueryInitiated value from the user's mailbox. Remove the value by running Set-Mailbox -AuditOwner @{Remove="SearchQueryInitiated"} and then add it to the user's mailbox in the forest where the user's mailbox is located.
Step 4: Set up Audit (Premium) for users
Tip
Organizations using Audit (Standard) can skip this step.
Audit (Premium) features such as the ability to log intelligent insights require an appropriate E5 license assigned to users. Additionally, the Advanced Auditing app/service plan must be enabled for those users.
To verify that the Advanced Auditing app is assigned to users, complete the following steps for each user:
In the Microsoft 365 admin center, go to Users > Active users, and select a user.
On the user properties flyout page, select Licenses and apps.
In the Licenses section, verify that the user is assigned an E5 license or is assigned an appropriate add-on license. For a list of licenses that support Audit (Premium), see Audit licensing requirements.
Expand the Apps section, and verify that the Microsoft 365 Advanced Auditing checkbox is selected.
If the checkbox isn't selected, select it, and then select Save changes.
The logging of Audit (Premium) insights begins within 24 hours.
Also, if you've customized the mailbox actions that are logged on user mailboxes or shared mailboxes, any new Audit (Premium) events released by Microsoft won't be automatically audited on those mailboxes. For information about changing the mailbox actions that are audited for each logon type, see the "Change or restore mailbox actions logged by default" section in Manage mailbox auditing.
Step 5: Set up audit retention policies in Audit (Premium)
Tip
Organizations using Audit (Standard) can skip this step.
In addition to the default policy that retains Microsoft Entra ID, Exchange, OneDrive, and SharePoint audit records for one year, organizations using Audit (Premium) can create audit log retention policies to meet the requirements of your organization's security operations, IT, and compliance teams.
For more information, see Manage audit log retention policies.
Step 6: Search for audited events
Now that you have Audit (Standard) or Audit (Premium) configured for your organization, you're ready to search the audit log in the Microsoft Purview compliance portal. For detailed guidance, see Search the audit log.