#Microsoft license audit how to
#Microsoft license audit license

* At this time, this event isn't available in Office 365 and Microsoft 365 Government GCC High and DoD environments. Other Advanced Audit events in Microsoft 365

#Microsoft license audit license

Users must be assigned an Advanced Audit license so that audit logs will be generated when users perform these events.ДЄdvanced Audit provides the following events: In addition to these events in Exchange and SharePoint, there are events in other Microsoft 365 services that are considered important events and require that users are assigned the appropriate Advanced Audit license. These events can help you investigate possible breaches and determine the scope of compromise. Advanced Audit eventsДЄdvanced Audit helps organizations to conduct forensic and compliance investigations by providing access to important events such as when mail items were accessed, when mail items were replied to and forwarded, and when and what a user searched for in Exchange Online and SharePoint Online. For more information, see Manage audit log retention policies. Also note that any custom audit log retention policy will take precedence over the default audit retention policy in case you need retain Exchange, SharePoint, or Azure Active Directory audit records for less than a year (or for 10 years) for some or all users in your organization. You can also specify how long to retain audit records that match the policy and a priority level so that specific policies will take priority over other policies. The user who performs an audited activity. The Microsoft 365 service where the audited activities occur. You can create a policy to retain audit records based on one or more of the following criteria: But you can create customized audit log retention policies to retain other audit records for longer periods of time up to 10 years. Audit log retention policiesДЄll audit records generated in other services that aren't covered by the default audit log retention policy (described in the previous section) are retained for 90 days. For more information, see the FAQs for Advanced Audit section in this article. This policy is not retroactive and can't retain audit logs that were generated before the 10-year audit log retention policy was created. After this license is assigned to a user and an appropriate 10-year audit log retention policy is set for that user, audit logs covered by that policy will start to be retained for the 10-year period. Retaining audit logs for 10 years will require an additional per-user add-on license. The 10-year retention of audit logs helps support long running investigations and respond to regulatory, legal, and internal obligations. In addition to the one-year retention capabilities of Advanced Audit, we have also released the capability to retain audit logs for 10 years. For more information, see the 'Default audit log retention policy' section in Manage audit log retention policies. Retaining audit records for longer periods can help with on-going forensic or compliance investigations. This is accomplished by a default audit log retention policy that retains any audit record that contains the value of Exchange, SharePoint, or AzureActiveDirectory for the Workload property (which indicates the service in which the activity occurred) for one year. Long-term retention of audit logsДЄdvanced Audit retains all Exchange, SharePoint, and Azure Active Directory audit records for one year.

#Microsoft license audit how to

This article provides an overview of Advanced Audit capabilities and shows you how to set up users for Advanced Audit. Microsoft 365 licensing guidance for security & compliance. For more information about licensing, see: A Microsoft 365 E5/A5/G5 Compliance or E5/A5/G5 eDiscovery and Audit add-on license should be assigned to users for Advanced Audit features such as long-term retention of audit logs and the generation of Advanced Audit events for investigations. Advanced Audit is available for organizations with an Office 365 E5/A5/G5 or Microsoft 365 Enterprise E5/A5/G5 subscription.