Test-MtPurviewAuditLogIngestion
SYNOPSIS
Ensure the Microsoft 365 unified audit log is enabled so tenant activity is captured for Microsoft Purview and downstream compliance controls.
SYNTAX
Test-MtPurviewAuditLogIngestion [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Checks the Microsoft 365 unified audit log ingestion state via Get-AdminAuditLogConfig.
The Microsoft Purview unified audit log is the tenant-wide record of user, admin and service activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, Microsoft 365 Copilot and many other workloads. It is the foundation for Microsoft Purview Audit, eDiscovery, Insider Risk Management, Communication Compliance, DSPM for AI activity explorer, and effectively every Purview investigation or reporting surface.
Without unified audit log ingestion, tenant activity is NOT captured, leaving organisations with no forensic record for audit, incident response, eDiscovery, or compliance investigations - including but not limited to Microsoft 365 Copilot prompt/response activity.
The test passes if the tenant returns UnifiedAuditLogIngestionEnabled = True.
EXAMPLES
EXAMPLE 1
Test-MtPurviewAuditLogIngestion
Returns true if the unified audit log is enabled.
PARAMETERS
-ProgressAction
Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
System.Boolean
NOTES
RELATED LINKS
https://maester.dev/docs/commands/Test-MtPurviewAuditLogIngestion