# Unified Audit Log

> Enable or disable the Unified Audit Log for the entire organisation.

Enable or disable the Unified Audit Log for the entire organisation.

## Settings this baseline controls

| Setting                     | What it does                                                                                                                                                                                      |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Audit log ingestion enabled | Controls whether unified audit log ingestion is enabled for the organization. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchange/set-adminauditlogconfig?view=exchange-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline keeps the tenant's audit log switched on in Exchange Online, so activity is
recorded and searchable.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Audit log ingestion enabled** switched on. It's the master switch for the tenant's
   audit log: with it off, nothing gets recorded or becomes searchable, whatever any other
   auditing setting says, including [Mailbox Audit Log](https://docs.octiga.io/baselines/audit/org-mailbox-audit-log/).
3. Auditing is on by default for most Microsoft 365 organisations, but not for the smaller
   Business Basic, Business Standard and Business Premium licences, or for an unmanaged
   enterprise trial. Those tenants need this baseline to turn it on rather than confirm it.
4. Save. Turn on **Auto-remediation** and Octiga switches this back on automatically if it's
   turned off. Users notice nothing: this only governs what gets recorded, not anything they
   see or do.

## Check it worked

**Passing** means Exchange Online reports audit log ingestion as enabled. Check it on the
**Audit** page of the Microsoft Purview portal: a banner prompting you to start recording user
and admin activity means it's off. Turning it on (or the baseline enforcing it) can take up to
an hour to apply fully, and new audit records can take a few more hours to become searchable.

## Standards this addresses

### CIS

- **M365 3.1.1** — CIS M365 Foundations Benchmark 3.1.1
- **v8 8.2** — CIS Controls v8 Safeguard 8.2

### NIST

- **PR.IP-1** — NIST CSF 2.0 PR.IP-1
- **AU-2** — NIST SP 800-53 AU-2
- **AU-12** — NIST SP 800-53 AU-12

### ISO 27001

- **A.8.16** — ISO/IEC 27001:2022 Annex A.8.16

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)