What is Unified Audit Log in Microsoft 365?

The Unified Audit Log (UAL) in Microsoft 365 is a centralized logging system that records user and admin activities across multiple Microsoft 365 services, including Exchange, SharePoint, Teams, OneDrive, and Entra ID (Azure AD). It helps organizations track, investigate, and respond to security incidents and compliance requirements.

Key Features of Unfied Audit Log

1. Comprehensive Activity Logging
• Captures events from Exchange Online, SharePoint, OneDrive, Teams, Power BI, and more.
2. Searchable Audit Data
• Admins can search logs using the Microsoft Purview Compliance Center or PowerShell.
3. Long-Term Data Retention
• Default 90-day retention for standard users; extended retention available with Microsoft 365 E5.
4. Detailed Event Information
• Records who performed an action, what was done, when it happened, and where.

Common Use Cases for the Unified Audit Log

1. Security Monitoring
   o Detect suspicious sign-ins, file access, or email forwarding rules that indicate a possible breach.
2. Compliance & Legal Investigations
   Retrieve logs for data protection regulations (GDPR, HIPAA, ISO 27001) and internal audits.
3. User Activity Tracking
   Monitor changes to documents, Teams messages, or administrative settings.

How to Search the Unified Audit Log

Admins can access audit logs via:

1. Microsoft Purview Compliance Center --> >Audit --> Search Audit Log
2. PowerShell (for advanced searches)

Search-UnifiedAuditLog -StartDate "2024-01-01" -EndDate "2024-02-01" -Operations "FileAccessed" -UserIds "user@domain.com"

Best Practices for Using Microsoft Exchange

1. Enable Audit Logging: Ensure audit log search is turned on in the Compliance Center.
2. Use Filters for Efficient Searching: Filter by date, user, workload, or action type to find relevant logs.
3. Set Up Alerts: Create alerts for high-risk activities like suspicious logins or external file sharing.

The Unified Audit Log is a critical tool for tracking security events, enforcing compliance, and gaining insights into Microsoft 365 activities.

Explore More

Search Unified Audit Logs Using Exchang PowerShell