Microsoft Purview Audit (Standard) logging SHALL be enabled

Contributed by Michael SouleAll contributors →

Part of CISA · Exchange Online · Audit logging · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.17.1

Overview

Microsoft Purview Audit (Standard) logging SHALL be enabled.

Rationale: Responding to incidents without detailed information about activities that took place slows response actions. Enabling Microsoft Purview Audit (Standard) helps ensure agencies have visibility into user actions. Furthermore, Microsoft Purview Audit (Standard) is required for government agencies by OMB M-21-31 (referred to therein by its former name, Unified Audit Logs).

Remediation action:

To enable auditing via the Microsoft Purview compliance portal:

1. Sign in to the Microsoft Purview compliance portal.
2. Under Solutions, select Audit.
3. If auditing is not enabled, a banner is displayed to notify the administrator to start recording user and admin activity.
4. Click the Start recording user and admin activity.

Related links

• Purview portal - Audit search
• CISA 17 Audit Logging - MS.EXO.17.1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.17.1
Severity	High
Suite	CISA
Product	Exchange Online
Related products	Purview
Feature	Audit logging
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.1
Criticality	SHALL
Upstream requirement	Moved to MS.SECURITYSUITE.5.1v1 (was MS.EXO.17.1v1)
Supports controls	cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12
PowerShell test	Test-MtCisaAuditLog
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.17.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.17.1.md