CISA.MS.EXO.17.2 - Microsoft Purview Audit (Premium) logging SHALL be enabled.
Overview
This is no longer applicable, and is deprecated by CISA. The content below is retained as a historical archive and will be removed in a future version.
Microsoft Purview Audit (Premium) logging SHALL be enabled.
Rationale: Standard logging may not include relevant details necessary for visibility into user actions during an incident. Enabling Microsoft Purview Audit (Premium) captures additional event types not included with Standard. Furthermore, it is required for government agencies by OMB M-21-13 (referred to therein by its former name, Unified Audit Logs w/Advanced Features).
Remediation action
To set up Microsoft Purview Audit (Premium), see Set up Microsoft Purview Audit (Premium) | Microsoft Learn.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.EXO.17.2 |
| Severity | Medium |
| Suite | CISA |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.17.2 |
| Criticality | SHALL |
| Supports controls | cisa-scuba:MS.EXO.17.2 |
| PowerShell test | Test-MtCisaAuditLogPremium |
| Services | Graph |
| Lifecycle | Deprecated |