Back to Checks
m365

Purview audit log search is enabled

purview_audit_log_search_enabled
Service: purviewSeverity: critical
OfficialBuilt-inVerified
Categories:logginge3
Resource Type:NotDefined

Microsoft Purview tenant setting for audit log search is assessed to confirm unified audit log ingestion (UnifiedAuditLogIngestionEnabled), which records user and admin activities and makes them searchable.

Prowler logoProwlerprowler-provider-m365

Risk

Without audit log ingestion/search, activity trails are missing or delayed, reducing visibility and accountability.

  • Data exfiltration and privilege abuse go undetected (confidentiality/integrity)
  • Incident response and forensics fail due to absent evidence, increasing dwell time

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks purview_audit_log_search_enabled

Recommendation

Enable and keep audit log search on (UnifiedAuditLogIngestionEnabled=true). Apply least privilege to audit roles, set retention aligned to sensitivity, forward logs to a SIEM for defense in depth, and routinely review and alert on audit events. Avoid disabling auditing even when using third-party tools.

Remediation

CLI

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Other

1Go to https://compliance.microsoft.com and sign in with an admin account
2Open Solutions > Audit
3Click Start recording user and admin activity
4Click Yes to confirm

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.purview.purview_client import purview_client


class purview_audit_log_search_enabled(Check):
    """Check if Purview audit log search is enabled.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for audit log search

        This method checks if audit log search is enabled Purview settings

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        audit_log_config = purview_client.audit_log_config
        if audit_log_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=audit_log_config if audit_log_config else {},
                resource_name="Purview Settings",
                resource_id="purviewSettings",
            )
            report.status = "FAIL"
            report.status_extended = "Purview audit log search is not enabled."

            if purview_client.audit_log_config and getattr(
                purview_client.audit_log_config, "audit_log_search", False
            ):
                report.status = "PASS"
                report.status_extended = "Purview audit log search is enabled."

            findings.append(report)

        return findings

References