Ensure Microsoft 365 unified audit log search is enabled

AltaNivel 1Automatizadam365

Descripción

The unified audit log is the primary record of user and admin activity across Exchange, SharePoint, Entra ID and Teams. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

Cómo se verifica

Método de auditoría: Comando de shell

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $c = Get-AdminAuditLogConfig -ErrorAction Stop; if ($c.UnifiedAuditLogIngestionEnabled -eq $true) { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true (or Microsoft Purview portal > Audit > Start recording user and admin activity).

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: m365logging
Referencia: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Audit / Microsoft 365 audit log search (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target m365