The settingWhat we hold this to
CreativeTechs minimum
Unified audit log search = enabled. Organization AuditDisabled = false. Per-mailbox audit actions populated (not empty) for Admin, Delegate and Owner. Retention ≥ 180 days.
Benchmark position
CIS M365 3.1.1 (L1) — audit log search enabled; Purview retains 180 days by default. CISA MS.EXO.17.3 — retained for at least the duration in OMB M-21-31, which is 12 months hot for federal bodies.
Where we differ, and why
We hold 180 days (the Microsoft default, and enough for the investigations we actually run). CISA's 12-month bar comes from a federal mandate that does not apply to our client base — take it per client where an insurer or contract asks for longer, and price the licence uplift.
Where the switch is
Purview portal → Solutions → Audit → turn on. Per-mailbox actions and the org flag are PowerShell only (below).
How to verify
Get-OrganizationConfig | fl AuditDisabled # expect False
Get-AdminAuditLogConfig | fl UnifiedAuditLogIngestionEnabled # expect True
Get-Mailbox -ResultSize Unlimited | ? {-not $_.AuditEnabled} # expect none- Why it matters
- Without it, incident response has nothing to read and an insurance claim has no evidence. Default retention is shorter than most investigations take to start.
- How we check
- Secure Score exo_mailboxaudit. CIS.M365.3.1.1 · L1, CISA.MS.EXO.13.1 and 17.1–17.3, Maester MT.1172.
- Fix — M365
- Set-OrganizationConfig -AuditDisabled $false. Then confirm per-mailbox audit actions are populated, not empty — the org flag alone is not the whole control. Purview → Audit → verify search is on.
- Fix — Google
- Audit logs on by default; set retention and export where required.
- User notices
- None.
- Expected pushback
- None. Retention beyond the default may need a licence uplift — price per client before promising a duration.