Articles and Insights

Get the latest news and updates from ECM Insights.

Unlock the Power of Auditing in Microsoft 365

January 13, 2024

Hey there, tech enthusiasts and guardians of digital sanctity! Today, we're diving into the nifty world of auditing in Microsoft 365 (Office 365). If you're not already basking in its glory, fear not! I'll walk you through the enchanting journey of enabling auditing, detecting if it's currently on, and why it's your digital fortress's best friend

What are Microsoft 365 Audit Logs (What are Office 365 Audit Logs)?

Why should you bother enabling auditing, you ask? Well, imagine this: Your Microsoft 365 audit logs are like installing a security camera in your digital mansion. Auditing helps you track who's been lurking around, what they've been up to, and safeguards your kingdom from potential mishaps, be it accidental deletions or suspicious activities. It's your guardian angel in the cyber realm! It helps you to identify the “who, what, when, where” and sometimes the “how” for your audit investigations preserving a legal chain of custody for your documents or other digital content in Microsoft 365.

When Does the Magic Begin?

Now, let's answer the big question: "When does auditing work its magic?" Well, by default, auditing in M365 should be switched on for most new enterprise organizations. It's like having a superpower but keeping it tucked away until you activate it! But you can’t always assume it was enabled for your organization when you first started using Microsoft 365, so it’s important you verify it is.

How to Check if Auditing is Enabled

First things first, let's play detective. To check if auditing is already strutting its stuff in your M365 environment:

1. Step into the Admin Portal:

   Slip into your admin cape and log into the Microsoft 365 admin center.

2. Navigate to the Compliance Center:

   Head to the Security & Compliance Center (https://compliance.microsoft.com/)

3. Seek the Audit Log Reports:

   Click on "Search" and then "Audit log search."

4. Look for Auditing Information:

   If you see data in there, hooray! Auditing is up and running. If there is a button indicating “Start recording user and admin activity” – that means auditing is not yet turned on for your Tenant. Click the button and Auditing will be enabled – note it can take a couple of hours for it to be fully enabled and propagated through your Microsoft 365 Tenant.

The Licensing Labyrinth: E3/G3 vs. E5/G5

Ah, the licensing labyrinth – a maze of possibilities! For all you heroes wielding an E5 license, rejoice! You've got the ticket. Auditing in M365 shines its brightest for you, offering a grand array of features and more insights. E5 license preserves your audit data (audit history) for up to 1 year for users licensed with that license type

But fear not, noble E3 champions! While your auditing abilities might not be as extensive, you still get a taste of its power. You'll have access to some auditing functionalities, just not the full banquet. E3 license preserves your audit data (audit history) for up to 180 days only for users licensed with that license type.

For many organizations preserving your audit history for 180 days or 1 year is simply not enough for regulatory, compliance and security purposes!

Examples:

• In forensic security investigation - organizations need to look back through several years of audit history and logs to determine a pattern or history of behavior for a User such as changing permissions, unauthorized accesses or downloads.
• In highly regulated environment like healthcare, pharmaceutical or financial services - organizations need to prove that documents like Standard Operating Procedures (SOPs) have an accurate historical audit trail for the lifetime of the document - documenting who has done what to the document and when: who edited it and when, who published it, and when it was last viewed.

Fear not – there is a trusted solution to satisfy more complex audit requirements.

Leveraging Audit Vault for M365 allows you to avoid losing your audit data (audit history) regardless of your Microsoft license type. Audit Vault for M365 enables a secure Audit Vault to preserve and maintains your audit log history for your organization’s Microsoft 365 Tenant for as long as you require – it doesn’t matter if some of your users are E1, E3, or E5 – we preserve it all! This saves you in yearly licensing cost, unlocks insights into your audit data via built-in and custom reports, and even allows you to expose your SharePoint Item history (audit log history) directly to your users from SharePoint!

Time to Unleash Auditing Awesomeness!

So, there you have it, adventurers! Enable auditing in your M365 tenant, revel in its insights, and shield your digital empire from the shadows. Embrace this security superhero and rest easy knowing your realm is fortified against the forces of chaos. To summarize by default Microsoft 365 E3 and E5 licenses provide you some protection (180 days or 1 year), with Audit Vault for M365 you are protected for as long as you require.

Make the choice to protect your Microsoft 365 Audit History today – for compliance, regulatory, ISO, and security information and event management (SIEM) requirements. Don’t wait, everyday you wait you lose more of your audit logs from Microsoft 365.

Sign Up Today

Getting started is easy. All it takes is 5 minutes to sign up and be protected.

Sign Up for a 14 Day Free Trial »