you are almost done first click run below

#You are almost done first click run below license

For more information, see Search-UnifiedAuditLog.įor information about exporting the search results returned by the Search-UnifiedAuditLog cmdlet to a CSV file, see the 'Tips for exporting and viewing the audit log' section in Export, configure, and view audit log records. You have to run this cmdlet in Exchange Online PowerShell. That means you can use this cmdlet to search the audit log instead of using the search tool on the Audit page in the compliance portal. The underlying cmdlet used to search the audit log is an Exchange Online cmdlet, which is Search-UnifiedAuditLog. To turn on audit search again, you can run the following command in Exchange Online PowerShell: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $trueįor more information, see Turn off audit log search. If you want to turn off audit log search for your organization, you can run the following command in Exchange Online PowerShell: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false For more information, see More information about mailbox audit logging. For more information, see Manage audit log retention policies.Įven when mailbox auditing on by default is turned on, you might notice that mailbox audit events for some users aren't found in audit log searches in the compliance portal or via the Office 365 Management Activity API.

Organizations can also create audit log retention policies to retain audit records for activities in other services for up to one year.

#You are almost done first click run below license

The length of time that an audit record is retained (and searchable in the audit log) depends on your Office 365 or Microsoft 365 Enterprise subscription, and specifically the type of the license that is assigned to specific users.įor users assigned an Office 365 E5 or Microsoft 365 E5 license (or users with a Microsoft 365 E5 Compliance or Microsoft 365 E5 eDiscovery and Audit add-on license), audit records for Azure Active Directory, Exchange, and SharePoint activity are retained for one year by default.

When an audited activity is performed by a user or admin, an audit record is generated and stored in the audit log for your organization. For more information, see Manage role groups in Exchange Online. To give a user the ability to search the audit log with the minimum level of privileges, you can create a custom role group in Exchange Online, add the View-Only Audit Logs or Audit Logs role, and then add the user as a member of the new role group. Global administrators in Office 365 and Microsoft 365 are automatically added as members of the Organization Management role group in Exchange Online. By default, these roles are assigned to the Compliance Management and Organization Management role groups on the Permissions page in the Exchange admin center. You have to be assigned the Audit Manager or Audit Reader role groups in compliance portal (preview) or the View-Only Audit Logs or Audit Logs role in Exchange Online to search the audit log. Although the Get-AdminAuditLogConfig cmdlet is also available in Security & Compliance PowerShell, the UnifiedAuditLogIngestionEnabled property is always False, even when audit log search is turned on.

Be sure to run the previous command in Exchange Online PowerShell.