Unified audit log ingestion is enabled
MT.1172HighPurviewAudit
Part of Maester · Purview · Audit · All checks
Invoke-Maester -TestId MT.1172Overview
Section titled “Overview”Ensure the Microsoft 365 unified audit log is enabled so tenant activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, Microsoft 365 Copilot and other workloads is captured for Microsoft Purview.
The unified audit log is the foundation for Microsoft Purview Audit, eDiscovery, Insider Risk Management, Communication Compliance, and the DSPM for AI activity explorer. Copilot prompt/response activity is one of many signals that flow into it — along with mailbox access, file operations, admin actions, sign-ins and every other workload event.
When UnifiedAuditLogIngestionEnabled is False:
- Tenant activity is not captured anywhere in Purview.
- Purview audit search returns no results.
- eDiscovery cannot find user or workload activity.
- Insider Risk Management policies cannot generate alerts.
- Communication Compliance policies will not match content.
- DSPM for AI activity explorer will be empty and Copilot interactions cannot be reviewed.
The test passes if Get-AdminAuditLogConfig returns UnifiedAuditLogIngestionEnabled = True.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online PowerShell as a Compliance Administrator or higher:
Connect-ExchangeOnline. - Run:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. - Allow up to 60 minutes for ingestion to begin and confirm by searching the Microsoft Purview audit search.
Related links
Section titled “Related links”- Microsoft Learn — Turn auditing on or off
- Microsoft Learn — Search the audit log
- Microsoft Learn — Audit logs for Microsoft 365 Copilot interactions
- Microsoft Learn — Data Security Posture Management for AI
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1172 |
| Severity | High |
| Suite | Maester |
| Product | Purview |
| Feature | Audit |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports controls | nist-800-53-r5:AU-12 |
| PowerShell test | Test-MtPurviewAuditLogIngestion |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/maester/purview/Test.MT.1172.ps1 - Documentation:
tests/maester/purview/Test.MT.1172.md