Microsoft Purview Audit (Premium) logging SHALL be enabled

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Exchange Online · Audit logging · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.17.2

Overview

This is no longer applicable, and is deprecated by CISA. The content below is retained as a historical archive and will be removed in a future version.

Microsoft Purview Audit (Premium) logging SHALL be enabled.

Rationale: Standard logging may not include relevant details necessary for visibility into user actions during an incident. Enabling Microsoft Purview Audit (Premium) captures additional event types not included with Standard. Furthermore, it is required for government agencies by OMB M-21-13 (referred to therein by its former name, Unified Audit Logs w/Advanced Features).

Remediation action

To set up Microsoft Purview Audit (Premium), see Set up Microsoft Purview Audit (Premium) | Microsoft Learn.

Related links

• Purview portal - Audit search
• CISA 17 Audit Logging - MS.EXO.17.2
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.17.2
Severity	Medium
Suite	CISA
Product	Exchange Online
Related products	Purview
Feature	Audit logging
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.2
Criticality	SHALL
Supports controls	cisa-scuba:MS.EXO.17.2
PowerShell test	Test-MtCisaAuditLogPremium
Services	Graph
Lifecycle	Deprecated

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.17.2.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.17.2.md