Skip to content
MitoMito Docs

CIS.M365.3.1.1: Ensure Microsoft 365 audit log search is Enabled
ID CIS.M365.3.1.1
Severity High
Suite CIS Microsoft 365 Foundations Benchmark
Product Purview
Feature Audit
Security area Logging and detection
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CIS Microsoft 365 Foundations Benchmark 7.0.0, 3.1.1 (L1, E3 Level 1)
Framework controls cis-m365:3.1.1
nist-800-53-r5:AU-12 Audit Record Generation
MITRE ATT&CK T1685.002
Reads from Exchange Online

What this checks and how to fix it

Section titled “What this checks and how to fix it”

3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled

When audit log search is enabled in the Microsoft Purview compliance portal, user and admin activity within the organization is recorded in the audit log and retained for 180 days by default. However, some organizations may prefer to use a third-party security information and event management (SIEM) application to access their auditing data. In this scenario, a Global Administrator can choose to turn off audit log search in Microsoft 365.

Rationale

Section titled “Rationale”

Enabling audit log search in the Microsoft Purview compliance portal can help organizations improve their security posture, meet regulatory compliance requirements, respond to security incidents, and gain valuable operational insights

Remediation action

Section titled “Remediation action”
  1. Navigate to Microsoft 365 Purview.
  2. Select Solutions and then Audit to open the audit search.
  3. Click blue bar Start recording user and admin activity.
  4. Click Yes on the dialog box to confirm.
PowerShell
Section titled “PowerShell”
  1. Connect to Exchange Online using Connect-ExchangeOnline.
  2. Run the following PowerShell command:
Terminal window
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Section titled “Related links”

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: NZLostboy; contributors: thomas-s-schmidt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.