# Audit

> Baselines that keep mailbox and unified audit logging turned on across a tenant.

Audit's two baselines keep Microsoft 365's record of what happened switched on: the tenant-wide unified audit log, and mailbox audit logging beneath it. Neither changes what users can do; they decide whether actions are recorded.

## Why it matters

When something goes wrong (a compromised account, a mailbox rule nobody set up, a file that shouldn't have moved), the audit log is the only place to find out what happened and when. It costs little to leave on and goes unnoticed while all is well, but if it was off, the record an investigation needs was never kept. Auditing is on by default for most Microsoft 365 subscriptions, but not for the smaller Business plans or an unmanaged enterprise trial, which are the tenants an MSP is most likely to be brought in to secure after the fact.

## How Microsoft evaluates it

Unified audit log ingestion is a single tenant-wide switch, set in Exchange Online PowerShell, that decides whether anything is recorded across Entra ID, Exchange, SharePoint and the rest of Microsoft 365. With it off, no other auditing setting in the tenant has any effect. Mailbox audit logging is a per-mailbox setting beneath it, recording the actions a user, delegate or admin takes inside a mailbox. Both are checked as tenant or mailbox configuration rather than per event, and both are searched the same way afterwards, through Microsoft Purview's audit search or the `Search-UnifiedAuditLog` cmdlet. ([Microsoft Learn: Turn auditing on or off](https://learn.microsoft.com/purview/audit-log-enable-disable), [Search the audit log for mailbox activities](https://learn.microsoft.com/purview/audit-log-search-for-mailbox-activities))

## What end users experience

Nothing changes for users either way: no prompts, nothing to see or select. Audit logging only decides whether their actions can be searched later by an administrator. Allow time after turning ingestion on, or after a baseline enforces it: it can take up to an hour to apply, and new records can take a few more hours to become searchable, so a fix here isn't visible straight away, even to the admin who made it.

| Baseline                                                                           | Scope  | Licence |
| ---------------------------------------------------------------------------------- | ------ | ------- |
| [Mailbox Audit Log](https://docs.octiga.io/baselines/audit/org-mailbox-audit-log/) | Tenant | —       |
| [Unified Audit Log](https://docs.octiga.io/baselines/audit/org-unified-audit-log/) | Tenant | —       |