# (L1) Ensure Microsoft 365 audit log search is Enabled

(L1) Ensure Microsoft 365 audit log search is Enabled. A Maester check for Purview, Audit.

Source: https://maester.dev/docs/tests/CIS.M365.3.1.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/nzlostboy" title="Ben Miles · Original author"><img src="https://github.com/NZLostboy.png" alt="Ben Miles" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/thomas-s-schmidt" title="Thomas Schmidt · Co-contributor"><img src="https://github.com/thomas-s-schmidt.png" alt="Thomas Schmidt" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/nzlostboy">Ben Miles</a> with <a href="/contributors/thomas-s-schmidt">Thomas Schmidt</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Purview · Audit · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.3.1.1
```

## Overview

3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled

When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 180 days by default. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a Global Administrator can choose to turn off audit log search in Microsoft 365.

#### Rationale

Enabling audit log search in the Microsoft Purview compliance portal can help organizations improve their security posture, meet regulatory compliance requirements, respond to security incidents, and gain valuable operational insights

#### Remediation action

1. Navigate to [Microsoft 365 Purview](https://purview.microsoft.com).
2. Select **Solutions** and then **Audit** to open the audit search.
3. Click blue bar **Start recording user and admin activity**.
4. Click **Yes** on the dialog box to confirm.

##### PowerShell

1. Connect to Exchange Online using `Connect-ExchangeOnline`.
2. Run the following PowerShell command:

```powershell
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
```

#### Related links

* [Microsoft 365 Purview](https://purview.microsoft.com)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 164](https://www.cisecurity.org/benchmark/microsoft_365)
* [Turn auditing on or off](https://learn.microsoft.com/purview/audit-log-enable-disable?view=o365-worldwide&tabs=microsoft-purview-portal)
* [Set-AdminAuditLogConfig](https://learn.microsoft.com/powershell/module/exchangepowershell/set-adminauditlogconfig?view=exchange-ps)
* [Verify the auditing status for your organization](https://learn.microsoft.com/purview/audit-log-enable-disable?view=o365-worldwide&tabs=microsoft-purview-portal#verify-the-auditing-status-for-your-organization)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.3.1.1 |
| Severity | High |
| Suite | CIS |
| Product | Purview |
| Feature | Audit |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 3.1.1 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:3.1.1, nist-800-53-r5:AU-12 |
| PowerShell test | [Test-MtCisAuditLogSearch](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.3.1.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.3.1.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.3.1.1.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.3.1.1.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.3.1.1.md)