Unified Audit Log
Enable or disable the Unified Audit Log for the entire organisation.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Audit log ingestion enabled | Controls whether unified audit log ingestion is enabled for the organization. Learn more |
Configure it
This baseline keeps the tenant’s audit log switched on in Exchange Online, so activity is recorded and searchable.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Leave Audit log ingestion enabled switched on. It’s the master switch for the tenant’s audit log: with it off, nothing gets recorded or becomes searchable, whatever any other auditing setting says, including Mailbox Audit Log.
-
Auditing is on by default for most Microsoft 365 organisations, but not for the smaller Business Basic, Business Standard and Business Premium licences, or for an unmanaged enterprise trial. Those tenants need this baseline to turn it on rather than confirm it.
-
Save. Turn on Auto-remediation and Octiga switches this back on automatically if it’s turned off. Users notice nothing: this only governs what gets recorded, not anything they see or do.
Check it worked
Passing means Exchange Online reports audit log ingestion as enabled. Check it on the Audit page of the Microsoft Purview portal: a banner prompting you to start recording user and admin activity means it’s off. Turning it on (or the baseline enforcing it) can take up to an hour to apply fully, and new audit records can take a few more hours to become searchable.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.