Microsoft 365 audit logs record user and admin activity across your tenant — who signed in, who accessed what file, who changed which setting, who sent which email. When something goes wrong — a compromised account, a data breach, a compliance investigation — audit logs are often the only way to understand what happened.
Microsoft 365 audit logging covers activity across Exchange, SharePoint, OneDrive, Teams, Azure AD, and more. Key events include:
From 2019, Microsoft enables audit logging by default for new Microsoft 365 tenants. However, older tenants may have it disabled. More importantly, mailbox auditing — which tracks access to individual mailboxes — has different defaults depending on your licence.
On E3 and E5, mailbox auditing is enabled automatically and logs owner, delegate, and admin access. On Business plans, mailbox auditing may not be configured by default and needs to be enabled manually via PowerShell.
Retention depends on your licence:
90 days sounds like a lot until you realise that many breaches aren't detected for months. If your organisation needs longer retention for compliance, consider E5 or the Advanced Audit add-on.
Useful searches after a suspected compromise: Filter by the affected user, set date range to 90 days before detection, and look for: unusual sign-in times/locations, mail forwarding rules created, permissions changes, file downloads in bulk.
In Exchange Online PowerShell: Set-OrganizationConfig -AuditDisabled $false
Or via the Microsoft 365 Defender portal: Settings → Cloud Apps → Connected apps → Office 365 → Audit log → Enable.
M365Clarity checks audit log status and mailbox auditing as part of every tenant scan, and flags any gaps with the relevant admin centre links to fix them.
Connect your tenant, run a scan, and see exactly what needs attention — in plain English. Free plan available.
Scan your tenant free →Related articles