Ensure Microsoft 365 unified audit log search is enabled

YüksekDüzey 1Otomatikm365

Açıklama

The unified audit log is the primary record of user and admin activity across Exchange, SharePoint, Entra ID and Teams. Requires an already-connected Exchange Online session: Install-Module ExchangeOnlineManagement; Connect-ExchangeOnline (View-Only Organization Management is sufficient). The audit throws if no session exists.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ConnectionInformation -ErrorAction SilentlyContinue) -or -not (Get-ConnectionInformation)) { throw 'Not connected: run Connect-ExchangeOnline first' }; $c = Get-AdminAuditLogConfig -ErrorAction Stop; if ($c.UnifiedAuditLogIngestionEnabled -eq $true) { 'compliant' } else { 'noncompliant' }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true (or Microsoft Purview portal > Audit > Start recording user and admin activity).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: m365logging
Referans: CIS Microsoft 365 Foundations Benchmark v7.0.0 - Audit / Microsoft 365 audit log search (verify section number for your release)

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target m365