Help Center

Find help articles, support information and more.

Import Historical Audit History Guide


Introduction:

Microsoft only retains your audit log data for a short period of time (180 days for E3 user licenses, 1 year for E5 user licenses). With Audit Vault for M365 you can import your historical that historical data and preserve it for as long as you require.

Historical audit log entries are any historical audit log entries or records that existed prior to when you signed up for Audit Vault for M365. It is possible for Audit Vault for M365 to pull in all historical audit log entries and records that may exist in your M365 Tenant.

In this guide we provide you instructions on how you can pull back all of your historical audit log entries from your Microsoft tenant.


What you'll learn:
  • How to import your organizations audit history from Microsoft into Audit Vault for M365.
Prerequisites:

Below is a list of pre-requisites you want to have ready in order to get started.

  • You have successfully set up and paid for your Audit Vault for M365 subscription.
  • You have a Microsoft 365 Global Administrator account for your tenant.


Import Audit History:
Grant Consent to App
  1. Navigate to https://auditvault365.com and "Sign In" with your tenant's Microsoft Global Admin Account.
  2. Browse to the Tenant > Tenant History page in the App.
  3. From the Tenant History tab, click on the "Historical Data Setup" button.
  4. Click on the "Grant Consent" button.
    • This will open up the Microsoft 365 sign-in page asking for a M365 Global Administrator to sign-in.
    • Sign in as your tenant's Global Administrator.
    • Review the requested permissions.
      • Sign in and read user profile
      • Manage Exchange As Application
    • Click “Accept”.
  5. Once accepted, you will be redirected back to the Tenant > Tenant History page.


Entra Admin Center Access

Audit Vault for M365 requires special access to run commands to extract the historical audit history from your tenant.

  1. Log into your tenant's Admin Portal: https://admin.microsoft.com/Adminportal/Home
  2. From the Admin centers, click on "Identity".
  3. From the left hand side Navigation, click on Roles & Admins > Roles & Admins.
  4. Search for "Exchange Administrator".
  5. Click on Exchange Administrator.
  6. Click on Add Assignment.
  7. Search for “ECM Insights : Historical Audit History Importer”.
  8. Click Add.
  9. Ensure access has been granted by clicking on the "Test Connection" button.


Start Import

Start importing your audit history into Audit Vault for M365.

  1. Click on the "Start Import" button.
Monitor Your Progress
  • From your Tenant History Page you can now view the import Job Status and % completion.
  • Your historical audit log history is now being loaded.
  • Note: This operation may take a long time to complete.


Congratulations! The Historical Import has been successfully setup and Audit Vault will start processing your tenant's historical audit logs.

Note: Audit Vault for M365 allows you to pull back all available historical audit data that may exist prior to the intial setup of your Tenant. If your Microsoft User licenses have audit logs that have passed the 180 day or 1 year audit log preservation dates those audit logs may have already been automatically purged by Microsoft. Audit Vault for M365 can only pull back what audit logs that Microsoft has available.
(Optional) Remove App Access Once Complete

Once your historical import is complete, you can remove the access needed for to run the historical import.

To remove access:

  1. Log into your tenant's Admin Portal: https://admin.microsoft.com/Adminportal/Home
  2. Navigate to Microsoft Entra Admin Center > Applications > Enterprise Applications
  3. Remove "ECM Insights : Historical Audit History Importer" application.


Need Help? Reach out to support by clicking the button below.

Contact Us »