Articles and Insights

Get the latest news and updates from ECM Insights.

Unlock the Power of Auditing in Microsoft 365

Hey there, tech enthusiasts and guardians of digital sanctity! Today, we're diving into the nifty world of auditing in Microsoft 365 (Office 365). If you're not already basking in its glory, fear not! I'll walk you through the enchanting journey of enabling auditing, detecting if it's currently on, and why it's your digital fortress's best friend

What are Microsoft 365 Audit Logs (What are Office 365 Audit Logs)?

Why should you bother enabling auditing, you ask? Well, imagine this: Your Microsoft 365 audit logs are like installing a security camera in your digital mansion. Auditing helps you track who's been lurking around, what they've been up to, and safeguards your kingdom from potential mishaps, be it accidental deletions or suspicious activities. It's your guardian angel in the cyber realm! It helps you to identify the “who, what, when, where” and sometimes the “how” for your audit investigations preserving a legal chain of custody for your documents or other digital content in Microsoft 365.

When Does the Magic Begin?

Now, let's answer the big question: "When does auditing work its magic?" Well, by default, auditing in M365 should be switched on for most new enterprise organizations. It's like having a superpower but keeping it tucked away until you activate it! But you can’t always assume it was enabled for your organization when you first started using Microsoft 365, so it’s important you verify it is.

How to Check if Auditing is Enabled

First things first, let's play detective. To check if auditing is already strutting its stuff in your M365 environment:

  1. Step into the Admin Portal:

    Slip into your admin cape and log into the Microsoft 365 admin center.

  2. Navigate to the Compliance Center:

    Head to the Security & Compliance Center (

  3. Seek the Audit Log Reports:

    Click on "Search" and then "Audit log search."

  4. Look for Auditing Information:

    If you see data in there, hooray! Auditing is up and running. If there is a button indicating “Start recording user and admin activity” – that means auditing is not yet turned on for your Tenant. Click the button and Auditing will be enabled – note it can take a couple of hours for it to be fully enabled and propagated through your Microsoft 365 Tenant.

The Licensing Labyrinth: E3/G3 vs. E5/G5

Ah, the licensing labyrinth – a maze of possibilities! For all you heroes wielding an E5 license, rejoice! You've got the ticket. Auditing in M365 shines its brightest for you, offering a grand array of features and more insights. E5 license preserves your audit data (audit history) for up to 1 year for users licensed with that license type

But fear not, noble E3 champions! While your auditing abilities might not be as extensive, you still get a taste of its power. You'll have access to some auditing functionalities, just not the full banquet. E3 license preserves your audit data (audit history) for up to 180 days only for users licensed with that license type.

For many organizations preserving your audit history for 180 days or 1 year is simply not enough for regulatory, compliance and security purposes!


  • In forensic security investigation - organizations need to look back through several years of audit history and logs to determine a pattern or history of behavior for a User such as changing permissions, unauthorized accesses or downloads.
  • In highly regulated environment like healthcare, pharmaceutical or financial services - organizations need to prove that documents like Standard Operating Procedures (SOPs) have an accurate historical audit trail for the lifetime of the document - documenting who has done what to the document and when: who edited it and when, who published it, and when it was last viewed.

Fear not – there is a trusted solution to satisfy more complex audit requirements.

Leveraging Audit Vault for M365 allows you to avoid losing your audit data (audit history) regardless of your Microsoft license type. Audit Vault for M365 enables a secure Audit Vault to preserve and maintains your audit log history for your organization’s Microsoft 365 Tenant for as long as you require – it doesn’t matter if some of your users are E1, E3, or E5 – we preserve it all! This saves you in yearly licensing cost, unlocks insights into your audit data via built-in and custom reports, and even allows you to expose your SharePoint Item history (audit log history) directly to your users from SharePoint!

Important Features and Requirements
Features Audit Vault for M365 Microsoft 365 – E3 License Microsoft 365 – E5 License Microsoft 365 – E5 License w/ 10 year retention
Fully integrated with Microsoft 365
Out-of-the-box reports
Retain your new audit log data (audit history) as long as you require
E3 (180 days only)

E5 (1 year only)

(Requires E5 + 10 year retention add-on license for all users!)
Retain your available existing historical audit log history as long as you require
E3 (180 days only)

E5 (1 year only)

(Requires E5 + 10 year retention add-on license for all users!)
Custom reporting w/predictive analytics and monitoring
Enable your own data lake
Enable and view your Doc + Folder Item Audit History from SharePoint
Proof of Defensible and Unaltered Document History – Ability to Generate Compliance Certificates
Comprehensive support for Compliance and Regulatory Requirements like GDPR, GxP, GCP, FDA 21 CFR Part 11, HIPAA, Sarbanes - Oxley, and ISO 9001
Support Legacy Document Migration Audit History preservation from other legacy systems into SharePoint Online
Access to reporting, search, and viewing audit logs - assignable to Users and Roles Only with admin privilege Only with admin privilege Only with admin privilege
Simple and cost-effective solution to cover securing, preserving and protecting all users and activity (audit logs) regardless of your Users’ Microsoft license types. Audit Vault for M365 does not require all of your Users to have Microsoft E5 license and a 10-year audit log retention add-on license for all Users to keep your audit logs for 10 years or more.
(Requires E5 + 10 year retention add-on license for all users!)

Time to Unleash Auditing Awesomeness!

So, there you have it, adventurers! Enable auditing in your M365 tenant, revel in its insights, and shield your digital empire from the shadows. Embrace this security superhero and rest easy knowing your realm is fortified against the forces of chaos. To summarize by default Microsoft 365 E3 and E5 licenses provide you some protection (180 days or 1 year), with Audit Vault for M365 you are protected for as long as you require.

Make the choice to protect your Microsoft 365 Audit History today – for compliance, regulatory, ISO, and security information and event management (SIEM) requirements. Don’t wait, everyday you wait you lose more of your audit logs from Microsoft 365.

Sign Up Today

Getting started is easy. All it takes is 5 minutes to sign up and be protected.

Sign Up for a 14 Day Free Trial »