Most business owners assume Microsoft 365 records everything that happens in their tenant. Some of it, yes. But the Microsoft 365 audit log has gaps that only show up when you need it most, usually in the middle of an incident. Knowing what is on by default and what you must switch on yourself takes about fifteen minutes, and it can save you weeks of guesswork later.
This guide covers the logs that matter for a small or mid-sized business, how long each one keeps data, and the settings I check in every tenant I review.
The four logs you actually care about
“Audit logging” in Microsoft 365 is really several separate logs, run by different services, with different retention. Mixing them up is the most common reason people think they have evidence when they do not.
Log
What it records
Default retention
Microsoft Purview unified audit log
User and admin activity across Exchange, SharePoint, OneDrive, Teams, Entra ID and more
180 days with Audit (Standard); one year for Exchange, SharePoint, OneDrive and Entra records for E5 users
Exchange mailbox auditing
Owner, delegate and admin actions inside mailboxes, such as inbox rule changes and deletions
Feeds the unified audit log, so follows Purview retention
Microsoft Entra sign-in logs
Every interactive and non-interactive sign-in, with IP, location, device and Conditional Access result
Notice that the Entra logs are short. If you only have Entra ID Free, you have one week of sign-in history. Business Premium includes Entra ID P1, which gives you 30 days. Neither is long if a compromise sat undetected for two months, which is not unusual.
What is on by default, and the surprise for small business tenants
The unified audit log
Microsoft describes audit logging as on by default for most Microsoft 365 organizations. The catch is in the small print. Microsoft’s own documentation says auditing is not enabled by default for small and medium business plans, including Business Basic, Business Standard and Business Premium, and it is not enabled for unmanaged tenants created from enterprise trials. Those tenants must turn it on manually.
That covers a large share of the businesses we work with. In the tenants I review, a missing unified audit log is one of the most frequent findings, and it is almost always a surprise to the owner.
Mailbox auditing
Mailbox auditing is on by default for all organizations and logs a predefined set of actions for owners, delegates and admins. You do not have to enable it per mailbox. Two cautions:
If someone customized the audited actions on a mailbox in the past, those settings stick and new default actions are not added automatically.
An admin can exclude specific accounts from mailbox auditing with an audit bypass. That should be rare, and you should know about it.
Entra sign-in and audit logs
These are always collected. You cannot turn them off, but you also cannot extend them beyond 7 or 30 days without sending them somewhere else.
How to check and enable the unified audit log
This is the single most important step in this article. It takes a few minutes.
Sign in to the Microsoft Purview portal with an account that holds the Audit Logs role (or Global Administrator for the first setup).
Open Solutions > Audit. If auditing is off, you will see a banner offering to start recording user and admin activity. Select it.
To confirm from PowerShell, connect to Exchange Online and run Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled. The value should be True.
If it is False, run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. It can take a few hours before searches return results.
Run a test search for your own activity from today to confirm records are arriving.
While you are there, check for audit bypass: Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled. An empty result is what you want.
Retention: how far back can you look?
Audit (Standard) keeps records for 180 days. Microsoft extended this from 90 days for logs generated on or after October 17, 2023. For most small businesses, 180 days covers the typical window between a compromise and someone noticing.
Audit (Premium), included with Microsoft 365 E5 or the E5 Compliance add-on, adds:
A default one-year retention for Exchange, SharePoint, OneDrive and Entra ID records for licensed users.
Custom audit retention policies, up to 10 years with the right add-on.
Higher bandwidth to the Office 365 Management Activity API, which matters if you pull logs into a SIEM.
Regulated businesses should check retention against their own obligations. A healthcare practice or a financial adviser may need audit evidence for longer than 180 days. If E5 is not in the budget, the practical alternative is exporting logs to cheap storage.
Keeping Entra logs longer
Because Entra sign-in logs expire after 30 days on P1, I recommend routing them out of Entra for any business that takes security seriously. Upgrading the license later does not bring expired data back.
Azure storage account: the cheapest option. Configure Entra ID > Monitoring & health > Diagnostic settings to send SignInLogs, NonInteractiveUserSignInLogs and AuditLogs to a storage account with a lifecycle policy.
Log Analytics workspace: more expensive, but searchable with KQL and usable for alerts, such as a notification whenever an emergency access account signs in.
Microsoft Sentinel: for businesses that want a full SIEM, usually with a managed security partner watching it.
Diagnostic settings require an Azure subscription and a P1 or P2 license. For a 50-person business, the storage option usually costs very little per month.
A quarterly audit logging checklist
Put this on the calendar. It takes twenty minutes and catches drift before it becomes a problem.
Unified audit log ingestion is True and a test search returns today’s activity.
No unexpected accounts have mailbox audit bypass enabled.
Entra diagnostic settings are still sending sign-in and audit logs to storage or Log Analytics.
Only the people who need it hold the Audit Logs or View-Only Audit Logs role.
Your incident runbook says where each log lives and who can search it.
Retention matches any regulatory or insurance requirements you have been given.
For the full detail on enabling and disabling auditing, Microsoft’s page Turn auditing on or off is the authoritative reference.
For most enterprise tenants, yes. For Business Basic, Business Standard and Business Premium, Microsoft says auditing is not enabled by default and must be turned on manually in the Microsoft Purview portal or with Set-AdminAuditLogConfig.
How long does Microsoft 365 keep audit logs?
Audit (Standard) keeps records for 180 days. With Audit (Premium) through E5, Exchange, SharePoint, OneDrive and Entra records are kept for one year by default, and custom policies can extend retention further with add-on licensing.
Does upgrading to Entra ID P1 give me older sign-in logs?
No. Retention changes are not retroactive. If you upgrade from Free, you only see whatever data was still inside the seven-day window. Export logs before you need them.
Want to know whether your audit trail would hold up in an incident? Request a free Microsoft 365 security assessment and we will check your logging, retention and alerting for you.
Most business owners assume Microsoft 365 records everything that happens in their tenant. Some of it, yes. But the Microsoft 365 audit log has gaps that only show up when you need it most, usually in the middle of an incident. Knowing what is on by default and what you must switch on yourself takes about fifteen minutes, and it can save you weeks of guesswork later.
This guide covers the logs that matter for a small or mid-sized business, how long each one keeps data, and the settings I check in every tenant I review.
The four logs you actually care about
“Audit logging” in Microsoft 365 is really several separate logs, run by different services, with different retention. Mixing them up is the most common reason people think they have evidence when they do not.
Notice that the Entra logs are short. If you only have Entra ID Free, you have one week of sign-in history. Business Premium includes Entra ID P1, which gives you 30 days. Neither is long if a compromise sat undetected for two months, which is not unusual.
What is on by default, and the surprise for small business tenants
The unified audit log
Microsoft describes audit logging as on by default for most Microsoft 365 organizations. The catch is in the small print. Microsoft’s own documentation says auditing is not enabled by default for small and medium business plans, including Business Basic, Business Standard and Business Premium, and it is not enabled for unmanaged tenants created from enterprise trials. Those tenants must turn it on manually.
That covers a large share of the businesses we work with. In the tenants I review, a missing unified audit log is one of the most frequent findings, and it is almost always a surprise to the owner.
Mailbox auditing
Mailbox auditing is on by default for all organizations and logs a predefined set of actions for owners, delegates and admins. You do not have to enable it per mailbox. Two cautions:
Entra sign-in and audit logs
These are always collected. You cannot turn them off, but you also cannot extend them beyond 7 or 30 days without sending them somewhere else.
How to check and enable the unified audit log
This is the single most important step in this article. It takes a few minutes.
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled. The value should beTrue.False, runSet-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. It can take a few hours before searches return results.While you are there, check for audit bypass:
Get-MailboxAuditBypassAssociation -ResultSize Unlimited | Where-Object AuditBypassEnabled. An empty result is what you want.Retention: how far back can you look?
Audit (Standard) keeps records for 180 days. Microsoft extended this from 90 days for logs generated on or after October 17, 2023. For most small businesses, 180 days covers the typical window between a compromise and someone noticing.
Audit (Premium), included with Microsoft 365 E5 or the E5 Compliance add-on, adds:
Regulated businesses should check retention against their own obligations. A healthcare practice or a financial adviser may need audit evidence for longer than 180 days. If E5 is not in the budget, the practical alternative is exporting logs to cheap storage.
Keeping Entra logs longer
Because Entra sign-in logs expire after 30 days on P1, I recommend routing them out of Entra for any business that takes security seriously. Upgrading the license later does not bring expired data back.
Entra ID > Monitoring & health > Diagnostic settingsto send SignInLogs, NonInteractiveUserSignInLogs and AuditLogs to a storage account with a lifecycle policy.Diagnostic settings require an Azure subscription and a P1 or P2 license. For a 50-person business, the storage option usually costs very little per month.
A quarterly audit logging checklist
Put this on the calendar. It takes twenty minutes and catches drift before it becomes a problem.
Trueand a test search returns today’s activity.For the full detail on enabling and disabling auditing, Microsoft’s page Turn auditing on or off is the authoritative reference.
Audit logging is one piece of a wider posture review. Our Microsoft 365 security assessment checks it alongside identity, email and device controls, and our Purview retention policy service covers the compliance side. If you just want a quick look at your tenant, try the tenant checker.
Frequently asked questions
Is the Microsoft 365 audit log on by default?
For most enterprise tenants, yes. For Business Basic, Business Standard and Business Premium, Microsoft says auditing is not enabled by default and must be turned on manually in the Microsoft Purview portal or with
Set-AdminAuditLogConfig.How long does Microsoft 365 keep audit logs?
Audit (Standard) keeps records for 180 days. With Audit (Premium) through E5, Exchange, SharePoint, OneDrive and Entra records are kept for one year by default, and custom policies can extend retention further with add-on licensing.
Does upgrading to Entra ID P1 give me older sign-in logs?
No. Retention changes are not retroactive. If you upgrade from Free, you only see whatever data was still inside the seven-day window. Export logs before you need them.
Want to know whether your audit trail would hold up in an incident? Request a free Microsoft 365 security assessment and we will check your logging, retention and alerting for you.