Ensure Microsoft 365 unified audit log search is enabled

TinggiLevel 1Otomatism365

Deskripsi

The unified audit log is the primary record of user and admin activity across Exchange, SharePoint, Entra ID and Teams. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

Cara pemeriksaan

Metode audit: Perintah shell

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $c = Get-AdminAuditLogConfig -ErrorAction Stop; if ($c.UnifiedAuditLogIngestionEnabled -eq $true) { 'compliant' } else { 'noncompliant' }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true (or Microsoft Purview portal > Audit > Start recording user and admin activity).

Properti

Sistem operasi: Apa saja
Tag: m365logging
Referensi: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Audit / Microsoft 365 audit log search (verify section number for your release)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target m365