CISA.MS.EXO.17.1 - Microsoft Purview Audit (Standard) logging SHALL be enabled.
Overview
Microsoft Purview Audit (Standard) logging SHALL be enabled.
Rationale: Responding to incidents without detailed information about activities that took place slows response actions. Enabling Microsoft Purview Audit (Standard) helps ensure agencies have visibility into user actions. Furthermore, Microsoft Purview Audit (Standard) is required for government agencies by OMB M-21-31 (referred to therein by its former name, Unified Audit Logs).
Remediation action:
To enable auditing via the Microsoft Purview compliance portal:
- Sign in to the Microsoft Purview compliance portal.
- Under Solutions, select Audit.
- If auditing is not enabled, a banner is displayed to notify the administrator to start recording user and admin activity.
- Click the Start recording user and admin activity.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.17.1 |
| Severity | High |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.1 |
| Criticality | SHALL |
| Upstream requirement | Moved to MS.SECURITYSUITE.5.1v1 (was MS.EXO.17.1v1) |
| Supports controls | cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12 |
| PowerShell test | Test-MtCisaAuditLog |
| Services | ExchangeOnline, SecurityCompliance |