# Unified audit log ingestion is enabled

Ensure the Microsoft 365 unified audit log is enabled so tenant activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, Microsoft 365 Copilot and…

Source: https://maester.dev/docs/tests/MT.1172

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/ofirgavish" title="Ofir Gavish · Original author"><img src="https://github.com/OfirGavish.png" alt="Ofir Gavish" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/ofirgavish">Ofir Gavish</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Purview · Audit · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1172
```

## Overview

Ensure the Microsoft 365 unified audit log is enabled so tenant activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, Microsoft 365 Copilot and other workloads is captured for Microsoft Purview.

The unified audit log is the **foundation** for Microsoft Purview Audit, eDiscovery, Insider Risk Management, Communication Compliance, and the DSPM for AI activity explorer. Copilot prompt/response activity is one of many signals that flow into it — along with mailbox access, file operations, admin actions, sign-ins and every other workload event.

When `UnifiedAuditLogIngestionEnabled` is `False`:

- Tenant activity is **not** captured anywhere in Purview.
- Purview audit search returns no results.
- eDiscovery cannot find user or workload activity.
- Insider Risk Management policies cannot generate alerts.
- Communication Compliance policies will not match content.
- DSPM for AI activity explorer will be empty and Copilot interactions cannot be reviewed.

The test passes if `Get-AdminAuditLogConfig` returns `UnifiedAuditLogIngestionEnabled = True`.

#### Remediation action

1. Connect to Exchange Online PowerShell as a Compliance Administrator or higher: `Connect-ExchangeOnline`.
2. Run: `Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true`.
3. Allow up to 60 minutes for ingestion to begin and confirm by searching the [Microsoft Purview audit search](https://purview.microsoft.com/audit/auditsearch).

#### Related links

- [Microsoft Learn — Turn auditing on or off](https://learn.microsoft.com/purview/audit-log-enable-disable)
- [Microsoft Learn — Search the audit log](https://learn.microsoft.com/purview/audit-search)
- [Microsoft Learn — Audit logs for Microsoft 365 Copilot interactions](https://learn.microsoft.com/purview/audit-copilot)
- [Microsoft Learn — Data Security Posture Management for AI](https://learn.microsoft.com/purview/ai-microsoft-purview)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1172 |
| Severity | High |
| Suite | Maester |
| Product | Purview |
| Feature | Audit |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports controls | nist-800-53-r5:AU-12 |
| PowerShell test | [Test-MtPurviewAuditLogIngestion](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1172.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/maester/purview/Test.MT.1172.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1172.ps1)
- Documentation: [`tests/maester/purview/Test.MT.1172.md`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1172.md)