[Thorough explanation] What are the types, acquisitions, and storage of Microsoft 365 audit logs?

1. Types of Microsoft 365 audit logs

In Microsoft 365, various operations are recorded as audit logs. The main types are as follows:

User Activity Logs

Records actions taken by the user (e.g., viewing, editing, or deleting files).
Track activities in SharePoint Online, OneDrive, Teams, and more.

Admin Activity Log

Record the history of settings changes and permission management operations performed by administrators.
This includes administrative operations such as Exchange Online, Azure AD, and Intune.

Authentication and Access Logs

Record user sign-in history and authentication attempts.
Azure AD audit logs to detect unusual login attempts.

Email-Related Audit Logs

Track the history of email interactions sent and received in Exchange Online.
You can monitor changes in email forwarding settings and rule application status.

2. How to get Microsoft 365 audit logs

How to Get Audit Logs

Method 1: Use the Microsoft Purview Compliance Portal

Here's how to do it:
- Log in to the Microsoft 365 admin center with your administrator account.
- Select Compliance from the left menu and open the Microsoft Purview compliance portal.
- Open the Audit section and set the search criteria.
- Press the "Search" button to get the corresponding log.
You can also export and analyze the results.

Method 2: Utilize PowerShell

PowerShell allows for more granular search and automation. The following steps are explained:
Open PowerShell and run the following command to connect to Microsoft 365.
• Connect-ExchangeOnline -UserPrincipalName < Admin account>
- Run the command to retrieve the audit log.
• Search-UnifiedAuditLog -StartDate <Start Date> -EndDate <End Date> -Operations < Audit Event> -ResultSize 1000
- Export to a CSV file if necessary.
• Search-UnifiedAuditLog -StartDate <Start Date> -EndDate <End Date> | Export-Csv -Path "C:\auditlog.csv" -NoTypeInformation

3. Why You Should Store Audit Logs and How Long to Retain them

Why Audit Log Keeping is Important

Proper storage of audit logs is crucial for the following reasons:

• Security incident investigation: Use it as evidence in the event of unauthorized access or data leakage.
  ・Compliance: Strengthening corporate governance and complying with laws and regulations (GDPR, J-SOX, etc.).
  - Business process optimization: Analyze user operation history to improve business flow.

How long do Microsoft 365 audit logs last?

Microsoft 365 has different plans for how long audit logs are retained.

License/Retention Period

Microsoft 365 E3/180

*Microsoft 365 E5/1 year (standard) Up to 10 years (extended option)

Microsoft 365 Business/180 days

The E5 plan allows for 1 year of log retention, and with the expansion option, you can retain it for up to 10 years. Depending on your company's compliance requirements, it's important to choose the right plan.

3-3. Recommended Methods for Storing and Backing Up Audit Logs

Microsoft 365 audit logs are deleted after a certain period of time, so we recommend exporting them to external storage or security information and event management (SIEM) for long-term storage as needed.

Recommended Storage Methods

We recommend storing audit logs in the following ways:
- Export to local or cloud storage
- Real-time monitoring with SIEM and SOC integration
Log management tools

Conclusion

Microsoft 365 audit logs are essential information for enhancing security and compliance. Understanding the types of logs, utilizing appropriate retrieval methods, setting retention periods, and managing them in conjunction with external tools as needed can enhance your organization's information security.
When operating Microsoft 365, ensure that you type, capture, and store audit logs to ensure that security measures are in place.

Colorkrew provides support for Microsoft 365 audit logs. If you have any problems with this kind of content, please feel free to contact us.