The unified audit log The unified audit log in Microsoft 365. Exchange, SharePoint, OneDrive, Teams, Entra ID, Purview and Copilot send audit records to the unified audit log. Full Entra sign-in logs, Entra ID Protection and Defender XDR telemetry are kept elsewhere with their own retention. Activity explorer, Audit search and PowerShell or the Graph API give access to the log. Audit Standard keeps records for 180 days, Audit Premium one year for the core workloads, and up to 10 years with an add-on. Records often arrive within minutes, but can take an hour or more. W AUDIT AND LOGGING The unified audit log Ada Admin Eli Employee WHY IT MATTERS Who did what, and when? That's the first question when something has happened. A file is gone, a mailbox is forwarding mail, a label was removed. In Microsoft 365, the answer is usually in one place: the unified audit log, often just called UAL. No record, no answer. And the log doesn't keep forever. MICROSOFT 365 WORKLOADS Unified audit log One timeline across workloads LOGGED ELSEWHERE, WITH ITS OWN RETENTION Stream them to Log Analytics or Microsoft Sentinel to keep them longer. THREE WAYS IN Same log, different tools Activity explorer leaves out sign-ins, mailbox rules, admin changes and files without labels or sensitive info. Search-UnifiedAuditLog retires 15 October 2027. The Graph AuditLogQuery API replaces it. RETENTION How far back you can look BEFORE YOU NEED IT Not instant, and on by default DELAY Records often arrive within minutes, but can take an hour or more. Microsoft doesn't commit to a time. CHECK THAT IT'S ON, IN EXCHANGE ONLINE POWERSHELL In Security & Compliance PowerShell, the same property always shows False. THE USER EXPERIENCE Eli notices nothing Every action becomes a record she never sees. Logging is silent. That's why it needs a legal basis and openness toward employees. Good to know 1/7 AUDIT AND LOGGING The unified audit log Every workload in Microsoft 365 writes to the same log. We look at what ends up there, what's logged elsewhere, how long it's kept, and the three ways to get the answers out. informasjonsbeskyttelse.no