One log, every workload
The unified audit log records activity across Exchange, SharePoint, OneDrive, Teams, Entra, Purview solutions and more — mailbox access, file operations, sharing, admin changes, DLP hits, label changes, eDiscovery actions. It is the backbone of every investigation timeline, because it's the one place the whole estate's actions converge. Auditing must be enabled for the tenant for it to capture (on by default for most, but worth confirming).
Standard vs premium
| Aspect | Standard | Premium |
|---|---|---|
| Retention of audit records | Shorter default window (commonly ~180 days) | Longer default (up to a year), extendable to multi-year via retention policies |
| High-value / "crucial" events | Core set | Additional events (e.g. mail-item access, search terms) that matter for breach scoping |
| Custom retention policies | Limited | Yes — set duration by workload/user/activity via New-UnifiedAuditLogRetentionPolicy |
| Higher API bandwidth for export | Base | Higher |
Premium is the difference between "we can see the last few months" and "we can reconstruct an incident from a year ago with the events that actually reveal exfiltration." It's E5-class (see the licensing concept).
Searching it — and the latency trap
You search via the portal's Audit Search or Search-UnifiedAuditLog. Two failure
modes dominate:
- Ingestion latency. Events are not instant — there's a delay (minutes to hours, occasionally longer) between an action and its appearance. "The event isn't there" often means "not yet," not "didn't happen." Don't conclude absence from a search run too soon.
- Retention aged-out. On standard, an event older than the window is simply gone — you cannot investigate a six-month-old incident on a 180-day log. This is why premium/long retention is a pre-incident decision: you can't retroactively extend history you didn't keep.
Result-set limits and pagination also matter: large investigations need scoped queries (date, user, operation) and often the async export path rather than one giant search.
Building the timeline
A clean investigation narrows by operation and actor first, correlates across workloads (a DLP hit, then a download, then an external share, then a sign-in from a new location), and pins each to its timestamp. The unified log's value is precisely this cross-workload correlation.
What to watch (proofs)
- Auditing on: confirm the tenant's audit config is enabled (portal / audit status) — a disabled log is a silent blind spot.
- Retention posture:
Get-UnifiedAuditLogRetentionPolicyfor custom retention — are the high-value events and key users kept long enough to matter? - Reachability: a scoped
Search-UnifiedAuditLogreturning the expected operations (e.g.FileDownloaded,SharingSet,MailItemsAccessed) — proof the events you'll need are actually being captured. - Latency awareness: when an expected event is absent, re-check after the ingestion window before concluding it didn't occur — the discipline that prevents false negatives.