# Microsoft Purview Audit (Standard) logging SHALL be enabled

Microsoft Purview Audit (Standard) logging SHALL be enabled. A Maester check for Exchange Online, Audit logging.

Source: https://maester.dev/docs/tests/CISA.MS.EXO.17.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cisa">CISA</a> · Exchange Online · Audit logging · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CISA.MS.EXO.17.1
```

## Overview

Microsoft Purview Audit (Standard) logging SHALL be enabled.

Rationale: Responding to incidents without detailed information about activities that took place slows response actions. Enabling Microsoft Purview Audit (Standard) helps ensure agencies have visibility into user actions. Furthermore, Microsoft Purview Audit (Standard) is required for government agencies by OMB M-21-31 (referred to therein by its former name, Unified Audit Logs).

#### Remediation action:

To enable auditing via the Microsoft Purview compliance portal:
1. Sign in to the **Microsoft Purview compliance portal**.
2. Under **Solutions**, select [**Audit**](https://purview.microsoft.com/audit/auditsearch).
3. If auditing is not enabled, a banner is displayed to notify the administrator to start recording user and admin activity.
4. Click the **Start recording user and admin activity**.

#### Related links

* [Purview portal - Audit search](https://purview.microsoft.com/audit/auditsearch)
* [CISA 17 Audit Logging - MS.EXO.17.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo171v1)
* [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/EXOConfig.rego#L898)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CISA.MS.EXO.17.1 |
| Severity | High |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.1 |
| Criticality | SHALL |
| Upstream requirement | Moved to MS.SECURITYSUITE.5.1v1 (was MS.EXO.17.1v1) |
| Supports controls | cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12 |
| PowerShell test | [Test-MtCisaAuditLog](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.17.1.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cisa/exchange/Test.CISA.MS.EXO.17.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.17.1.ps1)
- Documentation: [`tests/cisa/exchange/Test.CISA.MS.EXO.17.1.md`](https://github.com/maester365/maester/blob/main/tests/cisa/exchange/Test.CISA.MS.EXO.17.1.md)