Purview Audit: Turning On the Logs You’ll Need After a Breach

When a Microsoft 365 account is compromised, the first questions are usually straightforward:

• When did the attacker get in?
• Which account did they use?
• What did they read, download, change or delete?
• Did they create forwarding rules?
• Were other users or files affected?

The answers often depend on Microsoft Purview Audit.

Microsoft Purview’s unified audit log records activity from services including Exchange Online, SharePoint, OneDrive, Microsoft Teams, Microsoft Entra ID and other Microsoft 365 workloads. But those records are useful only when auditing is enabled, the right users are licensed, the retention period is long enough and your security team has permission to search them. 

The time to check those settings is before an incident—not while an attacker is already inside the tenant.

What Is Microsoft Purview Audit?

Microsoft Purview Audit provides a central place to search user and administrator activity across Microsoft 365.

Depending on the service and licensing, audit records can help show:

• User and administrator sign-ins and changes
• Mailbox access and message activity
• Inbox and mail-flow rule changes
• SharePoint and OneDrive file access
• File downloads, sharing and deletion
• Teams activity
• Microsoft Entra group and role changes
• Application and policy administration
• Microsoft 365 Copilot interactions and referenced content
• Backup policy and restore activity

Microsoft maintains an extensive catalogue of audited activities, and the available event types continue to expand as Microsoft 365 services change. 

Purview Audit does not replace Microsoft Entra sign-in logs, Defender alerts or endpoint telemetry. It complements them by showing what identities did inside Microsoft 365 after authentication.

Is Microsoft 365 Auditing Already Enabled?

For many Microsoft 365 organisations, unified auditing is enabled by default. You should still verify it.

In the Microsoft Purview portal:

1. Open Solutions.
2. Select Audit.
3. Check whether the page displays a banner asking you to start recording user and administrator activity.
4. If it does, select Start recording user and admin activity.

Auditing can also be checked through Exchange Online PowerShell:

Get-AdminAuditLogConfig |

    Format-List UnifiedAuditLogIngestionEnabled

A value of True indicates that unified audit-log ingestion is enabled.

When auditing is switched on, it can take up to 60 minutes to take effect, and new events may take several hours to become searchable. It does not reconstruct historical events from the period when auditing was disabled. 

That last point matters enormously. Discovering after a breach that auditing was disabled means evidence from before activation may simply not exist.

Do Not Turn Auditing Off to Reduce Noise

Turning off auditing prevents Microsoft Purview searches from returning records. It also prevents access to that audit data through the Office 365 Management Activity API and Microsoft Sentinel integrations. 

Audit volume should be managed through:

• Better searches
• Appropriate retention
• SIEM filtering
• Alert rules
• Investigation procedures

Disabling the evidence source is not a sensible way to reduce administrative noise.

Verify Mailbox Auditing Separately

Unified auditing and mailbox auditing are closely connected, but administrators should verify both.

Exchange Online enables mailbox auditing by default for newly created mailboxes and applies a Microsoft-managed set of audited actions for mailbox owners, delegates and administrators. Microsoft can add newly supported actions automatically when the mailbox remains on the managed default configuration. 

Check the organisation-level setting with Exchange Online PowerShell:

Get-OrganizationConfig |

    Format-List AuditDisabled

False means mailbox auditing on by default is enabled.

Be cautious when customising individual mailbox audit actions. Once you replace Microsoft’s default set for a sign-in type, Microsoft no longer automatically maintains that customised list. New audit actions may therefore be missed unless you update it yourself. 

For most small businesses, retaining Microsoft’s managed defaults is safer than building a complicated custom mailbox-auditing configuration without a specific compliance need.

Shared Mailboxes Need Attention Too

Shared mailboxes frequently handle some of the organisation’s most valuable information:

• Invoices
• Payroll queries
• Customer enquiries
• Supplier bank details
• HR correspondence
• Legal documents

Make sure your testing includes shared mailboxes such as:

accounts@company.co.uk

finance@company.co.uk

hr@company.co.uk

support@company.co.uk

Microsoft provides specific guidance for searching mailbox activity in both user and shared mailboxes, including how to troubleshoot missing records. 

Understand How Long Your Logs Are Kept

Audit logs are not stored forever automatically.

Microsoft Purview Audit Standard currently retains eligible audit records for 180 days by default. That period begins when the record is added to the audit log. 

Six months may be sufficient for many operational investigations, but it can be too short when:

• A breach remains undetected for months
• Fraud is discovered during an annual audit
• A former employee’s activity is investigated later
• A legal dispute concerns older events
• Cyber-insurance or regulatory evidence is required

Audit Premium can provide longer retention for appropriately licensed users. Audit-log retention policies can retain qualifying records for longer than 180 days, with support for up to one year under eligible E5 licensing and up to ten years when the required ten-year retention add-on is assigned. 

The important detail is that extended retention depends on the licence assigned to the user who generated the event—not simply the licence held by the administrator performing the search.

Audit Standard vs. Audit Premium

Audit Standard provides the unified audit log and core search capabilities needed for many investigations.

Audit Premium adds capabilities intended for more detailed forensic and compliance work. These include longer retention options and intelligent-insight events that can provide more information about activities such as mailbox access and user searches. 

Some Premium features require an eligible E5 licence and the Advanced Auditing service plan to be enabled for the relevant users. 

A small business does not automatically need the most expensive audit tier for every employee. A risk-based licensing decision may prioritise:

• Global administrators
• Finance and payroll staff
• Executives
• HR and legal employees
• IT and security personnel
• Users handling regulated information

However, confirm precisely how mixed licensing affects the records and retention your organisation expects to rely on.

Make Sure Investigators Have Access

Turning on auditing is not enough if nobody can search it during an emergency.

Users need the Audit Logs or View-Only Audit Logs role to search audit records. Microsoft’s built-in Audit Manager and Audit Reader role groups contain these permissions by default. 

Use least privilege:

• Audit Reader for personnel who need to search and review records
• Audit Manager for personnel who also need broader audit-management capabilities
• Global Administrator only where genuinely required

Avoid waiting until an incident to discover that the only employee with audit permissions is unavailable.

Assign at least two authorised, trained individuals and protect their accounts with strong authentication.

Test the Search Before You Need It

Run a controlled test after verifying auditing.

For example:

1. Create a test file in SharePoint.
2. Share it with another test user.
3. Download it.
4. Rename it.
5. Delete it.
6. Create and remove a test mailbox rule.
7. Wait for ingestion.
8. Search for the corresponding events in Purview Audit.

In the Audit solution, searches can be filtered by:

• Date and time
• User
• Activity
• Record type
• Workload
• File, folder or site
• Keyword

Save useful searches where supported and document the event names your team expects to use during common incidents. Microsoft’s current Audit search supports faster searches, saved searches and additional filtering compared with the retired classic search experience. 

Logs You Will Want After a Mailbox Compromise

For a suspected mailbox breach, useful events may include:

• Mailbox sign-in and access activity
• Inbox-rule creation or modification
• Mail forwarding changes
• Delegate-permission changes
• Message deletion
• Messages sent by the attacker
• Application consent
• Administrative role changes
• Authentication-method changes
• SharePoint and OneDrive access

Microsoft’s MailItemsAccessed mailbox-auditing action can help investigators assess which mailbox data was accessed. It is enabled by default for appropriately licensed Office 365 and Microsoft 365 E3 or E5 users. 

Do not assume every mailbox event will be available under every licence or configuration. Test searches using accounts representative of the users you intend to protect.

Logs You Will Want After Data Theft

When sensitive files may have been accessed, investigate:

• File viewed or accessed
• File downloaded
• File copied or moved
• Sharing link created
• External user invited
• Permission changed
• File deleted
• Site membership changed
• Teams or group membership changed

Correlate these records with Microsoft Entra sign-ins, endpoint alerts and the employee’s normal working pattern.

An audit event proves an action was recorded. It does not always prove the user physically performed it, because an attacker may have been using their authenticated session.

Export Evidence Properly

Purview search results can be exported for analysis and preservation.

The exported data often contains a JSON object in the AuditData field. Microsoft documents using Excel Power Query to split those properties into usable columns for investigation. Search results can also be exported using the Search-UnifiedAuditLog Exchange Online PowerShell cmdlet. 

For larger or recurring integrations, Microsoft recommends the Microsoft 365 Management Activity API rather than repeatedly using PowerShell scripts to download audit data. 

During an incident:

• Export relevant results promptly.
• Preserve an unchanged original copy.
• Record the search filters and time zone.
• Store evidence in a restricted location.
• Document who performed the export.
• Hash files where your forensic process requires it.
• Avoid editing the original evidence file.

Send Audit Data to a SIEM Where Appropriate

A SIEM can correlate Purview activity with:

• Entra sign-ins
• Endpoint alerts
• Firewall logs
• VPN records
• Email-security detections
• Threat intelligence

This can make it easier to detect patterns such as a risky sign-in followed by mass file downloads or new mailbox forwarding.

However, a SIEM does not correct missing source data. If unified auditing is disabled, Microsoft states that the Management Activity API and Sentinel cannot retrieve those audit records. 

Verify both ingestion and retention at the destination.

Create an Audit Readiness Checklist

Before a breach occurs, confirm that:

• Unified auditing is enabled.
• Mailbox auditing on by default is enabled.
• Shared mailboxes are included in testing.
• Audit roles are assigned to at least two trained people.
• High-risk users have the required licences.
• Audit Premium service plans are enabled where expected.
• Retention meets the incident-detection window.
• Important searches have been tested.
• Audit data is exported to a SIEM where required.
• The incident-response plan identifies who searches and preserves logs.

Review these settings at least annually and after licensing, security or tenant changes.

Common Purview Audit Mistakes

Assuming It Is Enabled Without Checking

Default settings can be changed, inherited from an older tenant or disabled during troubleshooting.

Discovering Retention Limits After the Incident

A six-month-old event cannot be retrieved if it has already expired.

Licensing Only the Investigator

Longer retention and Premium events may depend on the licence of the user generating the event.

Over-Customising Mailbox Auditing

Custom action lists may stop receiving Microsoft-managed updates.

Giving Everyone Global Administrator Access

Audit access should use dedicated, least-privileged roles.

Never Testing Searches

An untested logging system provides false confidence.

Treating Audit Logs as Alerts

Logs record evidence. They do not automatically ensure someone notices a live attack.

Final Thoughts

Microsoft Purview Audit is one of the most important evidence sources available after a Microsoft 365 breach.

But it must be prepared in advance.

Verify unified audit ingestion. Confirm mailbox auditing. Understand your licensing and retention. Assign appropriate roles. Test searches using real Microsoft 365 workloads, and preserve important data in a SIEM or longer-term audit policy where the business requires it.

The critical lesson is simple:

You cannot turn on yesterday’s logs today.

A few hours spent checking Purview Audit now may determine whether a future investigation produces a clear timeline—or a frustrating collection of unanswered questions.

Need Help Preparing Microsoft 365 Audit Logging?

Hamilton Group can help your organisation configure Microsoft Purview Audit before an incident occurs.

Our experts can help you:

• Verify unified and mailbox auditing
• Review Audit Standard and Premium licensing
• Configure audit-log retention
• Test mailbox, SharePoint and OneDrive events
• Assign least-privileged audit roles
• Build common breach-investigation searches
• Export audit data securely
• Integrate Microsoft 365 activity with a SIEM
• Investigate compromised accounts
• Create a documented audit and incident-response process

Visit hgmssp.com, call Hamilton Group on 0330 043 0069, or book a meeting with one of our experts to make sure the logs you will need after a breach are already being recorded.