📖 What is Unified Audit Log?
The Unified Audit Log is a centralized repository in Microsoft 365 that records user and administrator activities across Exchange, SharePoint, OneDrive, and Teams. It allows administrators to search and investigate events to troubleshoot issues or conduct forensic security analysis.
"Note that auditing must be explicitly enabled for the organization before events start being recorded in the log."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Unified Audit Log?
- ▸ Integrates events from multiple services including Exchange, SharePoint, OneDrive, and Teams into a single searchable interface for streamlined administrative oversight.
- ▸ Default retention for most licenses is 90 days, but Microsoft 365 E5 subscriptions allow for extended retention periods up to one year.
- ▸ Requires explicit activation at the organization level; events are not captured retroactively, making it essential to enable auditing immediately after tenant setup.
- ▸ Utilizes the Microsoft Purview compliance portal to filter searches by date range, specific users, and activity types for forensic investigation.
- ▸ Provides critical visibility into administrative changes and user actions, enabling the 'who, what, when, and where' analysis required for security audits.
🎯 How does Unified Audit Log appear on the MS-102 Exam?
You may be asked to identify the best tool for investigating a suspected data leak where a user may have downloaded sensitive files from SharePoint and OneDrive; the correct answer will involve searching the Unified Audit Log.
A scenario might describe a requirement to track administrator configuration changes over the past six months, requiring you to determine if the current license supports the necessary log retention period.
Expect questions where you must troubleshoot a 'missing' audit trail for a specific user action, leading you to verify if auditing was enabled at the organization level before the events occurred.
❓ Frequently Asked Questions
Does enabling the Unified Audit Log capture events that happened before it was turned on?
No, the Unified Audit Log does not capture events retroactively. It only begins recording activities from the moment auditing is enabled for the organization, which is why early activation is a critical best practice.
How does the Unified Audit Log differ from individual service logs like the Exchange Mailbox Audit Log?
The Unified Audit Log is a centralized aggregator that pulls events from across the M365 suite, whereas individual logs are service-specific and often require separate queries or tools to access and analyze.