Enterprise implementation of Microsoft Purview Audit demonstrating centralized audit logging, Unified Audit Log searches, security investigations, export of audit evidence, and compliance validation across Microsoft 365 workloads.
Microsoft Purview Audit provides a centralised, searchable record of user, administrator, application, and service activities across Microsoft 365 workloads. When a security incident occurs, the Unified Audit Log (UAL) is the primary data source for forensic investigation.
This project documents an enterprise implementation of Microsoft Purview Audit, covering audit configuration verification, targeted audit searches, structured investigation workflow, log export for evidence preservation, and integration with compliance reporting processes.
securem365lsb.onmicrosoft.com
Audit Standard
Insider Threat — File Access Pattern Analysis
| Challenge | Business Impact |
|---|---|
| No visibility into who accessed sensitive SharePoint documents | Unable to investigate potential data exfiltration |
| File deletions occur with no accountability record | Security team cannot determine scope of data loss |
| Privileged account actions not reviewed systematically | Compliance gap for administrator accountability |
| Security incidents investigated reactively, without data | Mean time to investigate (MTTI) is days, not hours |
| Regulatory auditors require evidence of monitoring controls | Failed audits, potential fines, remediation costs |
| Business Requirement | Microsoft Purview Component |
|---|---|
| Centralised activity logging | Unified Audit Log |
| Targeted investigation search | Audit Search (date, user, activity, workload filters) |
| Granular filtering | Activity Filters (file, mailbox, Teams, admin events) |
| Evidence preservation | Export to CSV with AuditData JSON |
| Standard retention & search | Audit Standard (90-day retention, E3/E5) |
| Extended retention & high-value events | Audit Premium (1–10 year retention, E5) |
| Property | Value |
|---|---|
| Tenant | Microsoft 365 E5 Trial (securem365lsb.onmicrosoft.com) |
| Portal | compliance.microsoft.com |
| Test Account | testuser1@securem365lsb.onmicrosoft.com |
| Investigation Period | 2026-07-01 to 2026-07-03 |
| Activity Investigated | FileAccessed (SharePoint Online) |
| Total Events Found | 12 audit records |
Microsoft 365 Activity Sources
│
├── Exchange Online
├── SharePoint Online
├── OneDrive
├── Microsoft Teams
└── Entra ID
│
▼
Unified Audit Log (compliance.microsoft.com)
├── 90-day retention (Audit Standard)
├── 1–10 year retention (Audit Premium)
└── Record Types: SharePoint, Exchange, AzureAD, Teams, OneDrive
│
▼
Investigation Tools
├── Audit Search (date / user / activity filters)
├── Results Review (activity, user, IP, workload)
├── CSV Export (evidence preservation)
└── PowerShell Automation
Verified audit is enabled for the tenant at compliance.microsoft.com → Solutions → Audit, and confirmed all workloads appear in the audit solution.
Configured search parameters including date range, activity type (FileAccessed
Configured search parameters including date range, activity type (FileAccessed), user (testuser1), and record type (SharePointFileOperation).
Submitted the search and monitored asynchronous progress as the Unified Audit Log was queried across all storage partitions, returning 12 audit records.
Reviewed returned audit events including date, user, activity, record type, IP address, and affected files, identifying a pattern consistent with data reconnaissance.
Exported the full CSV of matching audit events, preserving complete AuditData JSON for forensic context and compliance evidence.
Opened the exported CSV in Excel to verify completeness and accuracy, confirming all 12 events with full audit context.
| Test Case | Description | Result |
|---|---|---|
| TC-AUD-01 | Audit solution accessible at compliance.microsoft.com → Solutions → Audit | ✅ Pass |
| TC-AUD-02 | Audit search executes with date, user, and activity filters | ✅ Pass |
| TC-AUD-03 | Search completes with 12 results for testuser1 FileAccessed | ✅ Pass |
| TC-AUD-04 | Audit results display Activity, User, IP, Date, RecordType fields | ✅ Pass |
| TC-AUD-05 | Export completes and CSV downloads successfully | ✅ Pass |
| TC-AUD-06 | CSV validates in Excel with all 12 records and AuditData JSON intact | ✅ Pass |
Targeted audit log search with activity, user, and date filters.
Bulk audit export to CSV and JSON with retention-aware batching.
Audits configuration — enabled status, mailboxes, admin roles.
Connect-IPPSSession .\scripts\Search-UnifiedAuditLog.ps1 ` -StartDate "2026-07-01" ` -EndDate "2026-07-03" ` -UserIds "testuser1@securem365lsb.onmicrosoft.com" ` -Operations "FileAccessed" ` -OutputPath "C:\AuditExports"
| Feature | Audit Standard | Audit Premium |
|---|---|---|
| Audit Search | ✅ | ✅ |
| Export to CSV | ✅ | ✅ |
| Retention | 90 days | 1–10 years |
| High-Value Events | Limited | Enhanced (MailItemsAccessed, Send) |
| Advanced Investigation | ❌ | ✅ |
| Licensing | E3 / E5 | E5 / Compliance Add-On |
| Issue | Likely Cause | Resolution |
|---|---|---|
| Audit solution not visible | Missing role | Assign Audit Logs or View-Only Audit Logs role |
| Search returns no results | Audit not enabled | Run Get-AdminAuditLogConfig to verify |
| Events missing for a user | User excluded from audit | Check per-user audit settings in Exchange |
| Export fails silently | Permissions issue | Verify Compliance Administrator or eDiscovery roles |
| Search times out | Overly broad scope | Narrow date range or add user/activity filters |
This repository documents an enterprise Microsoft Purview Audit implementation performed in a Microsoft 365 E5 lab tenant.
View Repository on GitHub