Today’s post will help to enable the admin audit log Microsoft 365 for all administrators within the M365 Portal ?
The issue:
For whatever reason, the audit log in microsoft 365 has not been automatically enabled on older tenancies by default ?. Any tenancy pre 2020, will need this enabling.
Top Tip: Microsoft have since rectified this odd behavior and going forward all new tenancies do have it enabled.
This has caught several clients out in the past where they have had an older tenancy and have had the need to search the log to find an engineers actions etc and it doesnt exist ?
If you do not have the Microsoft 365 audit logs enabled will result in your administrators not being able to track your admin events, at all!
Here I will show you how to enable the administrators audit log for a Microsoft 365 tenancy.
The resolution:
Use the compliance center to turn on auditing
Go to the compliance centre and sign in, in the left navigation pane of the Microsoft 365 compliance center, click Show all, and then click Audit.
If auditing is not turned on for your organization, this will show you a banner displaying start recording user and admin activity.
Click the Start recording user and admin activity
It may take up to 60 minutes for the change to take effect.
Use PowerShell to turn on auditing
Connect to Exchange Online PowerShell and run the following command to check auditing in Microsoft 365:
Get-AdminAuditLogConfig
For instance, you can use the following command to turn it on or off:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true for on
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false for off
As a result, you receive the message: it may take up to 60 minutes for the change to take effect.
You can find out more about how to use the Admin audit log here
For more help with Exchange Online or anything else cloud related, please feel free to get in touch ?
