Ensure Microsoft 365 unified audit log search is enabled

높음레벨 1자동m365

설명

The unified audit log is the primary record of user and admin activity across Exchange, SharePoint, Entra ID and Teams. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

점검 방법

감사 방식: 셸 명령

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $c = Get-AdminAuditLogConfig -ErrorAction Stop; if ($c.UnifiedAuditLogIngestionEnabled -eq $true) { 'compliant' } else { 'noncompliant' }

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true (or Microsoft Purview portal > Audit > Start recording user and admin activity).

속성

운영 체제: 모두
태그: m365logging
참고 자료: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Audit / Microsoft 365 audit log search (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target m365