Skip to main content
This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 12 · What

Chapter 04 — Azure Platform and Microsoft 365 Audit Telemetry

How to emit the Azure activity log and resource logs, why resource-specific tables beat AzureDiagnostics, how Azure Policy keeps new resources from being born silent and where DeployIfNotExists stops, and how to verify, collect and retain the Microsoft 365 unified audit log through the Office 365 Management Activity API, including its timing and ordering rules, GCC endpoints and the license-dependent retention tiers.

An agency that exports only the activity log can prove a key vault was created and can’t prove who read its secrets; one that never checks its unified audit log may have no Microsoft 365 history at all.

NoteIn this chapter

The two Azure emission paths, the activity log (control plane) and resource logs (data plane), and how to export each by CLI and Bicep. Why the program sends resource logs to resource-specific tables, and how Azure Policy’s DeployIfNotExists enforces emission on new resources, with the limits that leave gaps if nobody runs a remediation task. Then the third emission path, the Microsoft 365 unified audit log: confirming it is on, registering for the Office 365 Management Activity API, the subscription and content rules that break first-time collectors, the GCC endpoints, and the license tiers that decide how long the evidence survives.

Chapter 03 covered identity. Neither of the two pipelines in this chapter is touched by the Entra diagnostic setting: Azure resource activity has its own diagnostic settings, and Microsoft 365 workload activity (Exchange, SharePoint, OneDrive, Teams, Power Platform, Purview) lives in the unified audit log, read through its own API. An agency can have perfect identity telemetry and still be blind to what happened inside its subscriptions and its mailboxes.

Three columns, each a stack of cards. Left, blue: Azure control plane, the activity log, collected by default and kept 90 days, exported by one diagnostic setting per subscription to the AzureActivity table; it records create, update, delete and action operations and RBAC changes but typically not reads. Middle, blue: Azure resource plane, resource logs, not collected by default, one diagnostic setting per resource, enforced by Azure Policy DeployIfNotExists plus remediation tasks, landing in resource-specific tables. Right, slate: Microsoft 365 unified audit log, verified with Get-AdminAuditLogConfig in Exchange Online PowerShell, collected through Office 365 Management Activity API subscriptions to five content types, retained 180 days or one year by license. All three columns point down to a violet card: one workspace, one verification loop.
Figure 1: Three emission paths, three mechanisms: subscription diagnostic settings for the activity log, per-resource settings enforced by Azure Policy for resource logs, and the Management Activity API for the unified audit log.

Part 1: the Azure activity log

The activity log records control-plane operations: creating a virtual machine, changing a key vault access policy, a failed deployment. Azure collects it by default, keeps it for 90 days and then deletes it, and doesn’t charge for it during that time.1 It “doesn’t typically capture read operations.”2 Exporting it to a Log Analytics workspace incurs no ingestion charge, only retention beyond 90 days, and the data lands in the AzureActivity table.3 One more reason to export it: the activity log is the only place Azure records who created a resource, and that record expires with the 90-day window.4

Categories

Category Contains
Administrative Every create, update, delete and action operation through Resource Manager, including all Azure RBAC changes in the subscription
Security Alerts generated by Microsoft Defender for Cloud
Policy Every effect action Azure Policy performs, such as audit and deny
ServiceHealth Azure service health incidents affecting the subscription’s resources
ResourceHealth Resource health changes: Available, Unavailable, Degraded, Unknown
Alert Azure alert activations
Autoscale Autoscale engine operations
Recommendation Azure Advisor recommendations

Definitions are from the activity log schema.5 Administrative, Security and Policy are the core of the evidence: Administrative is where Azure RBAC changes are recorded,6 which makes it the account-management and least-privilege evidence (AC-2, AC-6) for the Azure estate.7 The program enables all eight. The volume is small next to resource logs and there is no ingestion charge, and the two health categories are what lets an incident team rule out a platform outage before blaming an attacker.

Export by CLI

The activity log needs the subscription form of the command. Microsoft’s guidance is to use az monitor diagnostic-settings subscription create or update; the plain az monitor diagnostic-settings create is resource-scoped.8

WarningIllustrative code

The commands, templates and queries in this chapter are illustrative. They haven’t been tested against a production subscription or tenant. Check each command, parameter, table and endpoint against the Microsoft Learn pages cited, run it first in a test environment, and put it through the program’s change control before production.

az monitor diagnostic-settings subscription create \
  --name "fmp-activity-log-export" \
  --location "<region>" \
  --workspace "/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RG}/providers/Microsoft.OperationalInsights/workspaces/${WORKSPACE}" \
  --logs '[
    {"category": "Administrative", "enabled": true},
    {"category": "Security",       "enabled": true},
    {"category": "Policy",         "enabled": true},
    {"category": "ServiceHealth",  "enabled": true},
    {"category": "ResourceHealth", "enabled": true},
    {"category": "Alert",          "enabled": true},
    {"category": "Autoscale",      "enabled": true},
    {"category": "Recommendation", "enabled": true}
  ]'

The command’s parameters (--name, --location, --workspace, --logs) and the eight category names match Microsoft’s CLI reference and its example.9

ImportantNew-AzDiagnosticSetting can’t export the activity log

Microsoft’s PowerShell guidance for diagnostic settings is explicit: “You can’t use this method for an activity log.” It directs PowerShell users to deploy a Resource Manager template instead.10 Teams that standardize on PowerShell sometimes conclude from a failed New-AzDiagnosticSetting call that the activity log can’t be exported. It can; use the subscription CLI command or the template below.

Export by Bicep at subscription scope

// activity-log-export.bicep
// Deploy with: az deployment sub create --location <region> --template-file activity-log-export.bicep
targetScope = 'subscription'

param workspaceId string
param settingName string = 'fmp-activity-log-export'

var categories = [
  'Administrative'
  'Security'
  'Policy'
  'ServiceHealth'
  'ResourceHealth'
  'Alert'
  'Autoscale'
  'Recommendation'
]

resource activityLogExport 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: settingName
  properties: {
    workspaceId: workspaceId
    logs: [for category in categories: {
      category: category
      enabled: true
    }]
  }
}

Management groups don’t replace subscription settings

The source pages for this chapter suggested setting the activity log export once at the top management group instead of on every subscription. Microsoft’s guidance doesn’t support that. A management-group diagnostic setting exports activity log events for that management group and all management groups beneath it, but it “doesn’t capture every subscription-level activity log event.” Resource Manager writes a hierarchy property on its events, resource providers outside Resource Manager don’t, and events without it never propagate upward, not even to the root management group.11 Microsoft’s answer is a subscription-level setting on every subscription, with all categories selected, kept even when a management group also exports.12

The program does both: a management-group setting for management-group events (policy assignments, hierarchy changes) and a subscription setting everywhere, enforced by policy (Part 3). That produces some duplicate events, which Microsoft accepts as the price of not missing any, and removes at query time with a hash of all fields:13

AzureActivity
| extend Hash = hash(dynamic_to_json(pack_all()))
| summarize arg_max(TimeGenerated, *) by Hash

An assessor accepts a deduplicated stream. Nobody accepts a gap.

Part 2: resource logs

Resource logs record data-plane operations inside a resource, such as getting a secret from a key vault or making a request to a database. They aren’t collected by default, and each resource needs its own diagnostic setting.1415 Each resource can carry up to five diagnostic settings, and a single setting can send to at most one destination of each type.16 Microsoft also notes that resource logs “aren’t completely lossless”: the pipeline retries but doesn’t give transactional guarantees,17 which is one reason the program’s verification checks for liveness rather than assuming delivery.

Categories vary by resource type. Discover what a resource supports before writing its setting:

az monitor diagnostic-settings categories list \
  --resource "${RESOURCE_ID}" \
  --query "value[].{name:name, type:categoryType, groups:categoryGroups}" -o table

Then create the setting with a category group. allLogs means every category the resource has, and audit means the logs that record customer interactions with data or the service’s settings; if Microsoft adds a category to a group later, collection picks it up automatically.18 The program uses allLogs as the baseline because it survives new categories:

az monitor diagnostic-settings create \
  --name "fmp-resource-logs" \
  --resource "${RESOURCE_ID}" \
  --workspace "${WORKSPACE_RESOURCE_ID}" \
  --logs '[{"categoryGroup": "allLogs", "enabled": true}]' \
  --metrics '[{"category": "AllMetrics", "enabled": true}]' \
  --export-to-resource-specific true

Two notes from Microsoft’s guidance apply. Not every service offers category groups, and where it doesn’t, the option isn’t there.19 And enabling the audit category for Azure SQL Database doesn’t turn on database auditing; that is configured on the database’s auditing pane.20 A diagnostic setting routes logs; it doesn’t make a service generate them.

Resource-specific tables, not AzureDiagnostics

--export-to-resource-specific true sends logs to a dedicated table per category instead of the shared AzureDiagnostics table. Microsoft lists the advantages (easier queries, discoverable schemas, better ingestion and query performance, and RBAC on a specific table), says all Azure services will eventually use resource-specific mode, and recommends it for any new diagnostic setting where a choice is offered.21 Most resources don’t offer a choice; they write in one mode or the other.22

For compliance work the deciding issue is the column limit. Every Log Analytics table is limited to 500 columns, and AzureDiagnostics, which collects the superset of every resource type’s fields, is the table most likely to hit it.23 Data isn’t lost when that happens, as the source page claimed; it is moved into a dynamic property bag column called AdditionalFields.24 The effect on detection is nearly as bad, though: a rule written against a named column silently stops matching once that field starts arriving inside AdditionalFields, and every query has to typecast what it extracts.25 Resource-specific tables have their own schema and can’t be crowded out. The trade-off is that rules must name the specific table. The program decides once, resource-specific wherever offered, and applies it everywhere, because a fleet that mixes modes is the hardest to write detections for. Switching an existing setting to resource-specific mode leaves earlier data in AzureDiagnostics until retention removes it, so queries need a union across both tables for the transition period.26

WarningThe self-reference loop and the rename trap

A storage account or Event Hubs namespace can’t be selected as the destination for its own resource logs in the portal, because writing logs about writing logs would loop forever. Microsoft notes that this block exists only in the portal: PowerShell, the CLI, the REST API and Resource Manager templates will create the loop if told to.27 Any script that applies a setting to every resource in a subscription must exclude the logging storage accounts and event hubs explicitly.

Microsoft also warns to delete a resource’s diagnostic settings when the resource is deleted, renamed or moved; otherwise a resource re-created with the same identity can inherit the old setting.28 Decommissioning runbooks include that step.

Part 3: enforce emission with Azure Policy

Everything above configures what exists today. A resource created tomorrow is born silent unless policy makes emission a property of the platform rather than a checklist item. Azure Policy’s built-in definitions cover both Azure paths:

Built-in Effect Scope
Configure Azure Activity logs to stream to specified Log Analytics workspace DeployIfNotExists Subscription activity log29
Enable allLogs category group resource logging for supported resources to Log Analytics (initiative, 140 policies) DeployIfNotExists per resource type Resource logs30
Enable audit category group resource logging for supported resources to Log Analytics (initiative, 69 policies) DeployIfNotExists per resource type Resource logs, audit group only31
Enable logging by category group for <resource type> to Log Analytics DeployIfNotExists, AuditIfNotExists or Disabled One resource type32

The program assigns the activity log policy and the allLogs initiative at the top management group, with an AuditIfNotExists assignment where an assessment-only view is wanted first. The initiatives cover “supported resources,” a list of resource types, not every resource type in Azure, so a resource type outside the list needs its own definition or a documented exception.

ImportantWhere DeployIfNotExists stops

A DeployIfNotExists policy acts when a resource provider handles a create or update request and returns success; it then waits a configurable delay (10 minutes by default) and deploys its template if the related resource, here the diagnostic setting, doesn’t exist or doesn’t meet the existence condition.33 During a regular compliance evaluation it only marks matching resources non-compliant and takes no action; existing resources are fixed only by a remediation task.34 The common failure: the initiative is assigned, new resources comply, the dashboard trends green, and every resource that predates the assignment goes on emitting nothing.

Remediation tasks have limits of their own. One task remediates one DeployIfNotExists policy at a time, so an initiative of 140 policies needs a task per non-compliant policy. A task remediates 500 resources by default, up to 50,000. A remediation task can be created during assignment only for subscription-level assignments; for management-group assignments it is created after evaluation has determined compliance.35

The assignment’s managed identity does the deployment and needs the roles in the definition’s roleDefinitionIds. Built-in definitions carry those roles already, and the portal grants them automatically; an assignment created by SDK, template or pipeline must grant them by hand, or every remediation deployment fails.36 Changing a definition doesn’t update the identity’s roles.37

The PowerShell and CLI forms are Start-AzPolicyRemediation -Name <name> -PolicyAssignmentId <id> and az policy remediation create --name <name> --policy-assignment <id>, with -ResourceCount and -ParallelDeploymentCount to size the run.38 The program’s sequence is: assign, wait for the first evaluation, run a remediation task per policy, then compare the compliant count with the resource inventory.

That comparison is also the program’s answer to FedRAMP’s KSI-MLA-EVC (configurations, especially infrastructure as code, continuously evaluated and tested) and KSI-MLA-LET (a current list of the event types logged).39 A policy assignment that evaluates continuously against the full inventory is that evaluation; a spreadsheet of resources somebody checked once is not. Servers outside Azure are governed through Azure Arc and machine configuration, covered in Book 05.

Verify Azure emission

Control-plane liveness, by subscription and category:

// Azure control-plane emission health.
AzureActivity
| where TimeGenerated > ago(24h)
| summarize Events = count(), LastEvent = max(TimeGenerated)
    by SubscriptionId, CategoryValue
| extend Stale = LastEvent < ago(6h)
| order by Stale desc, SubscriptionId asc, CategoryValue asc

CategoryValue and SubscriptionId are the documented AzureActivity columns for category and subscription.40 Microsoft notes that string values in this table can vary in case, so comparisons should use case-insensitive operators such as =~.41 A quiet category, such as Autoscale in a subscription with no autoscale settings, is normal; a quiet Administrative category in a working subscription is not.

The query can’t show a subscription that has never sent an event, which is precisely the one to find. Check the settings directly against the subscription list:

# Subscriptions with no activity-log diagnostic setting.
for sub in $(az account list --query "[].id" -o tsv); do
  count=$(az monitor diagnostic-settings subscription list \
            --subscription "$sub" --query "length(value)" -o tsv 2>/dev/null || echo 0)
  [ "${count:-0}" -eq 0 ] && echo "NO ACTIVITY LOG EXPORT: $sub"
done

Resource types still arriving in the shared table are the migration backlog for resource-specific mode:

AzureDiagnostics
| where TimeGenerated > ago(24h)
| summarize Events = count(), LastEvent = max(TimeGenerated) by ResourceType, ResourceProvider
| order by Events desc

None of these queries proves completeness; they prove that something is arriving. Only the policy compliance state, evaluated against the full resource inventory, shows coverage. The program reports the compliance percentage as the policy input to the collection coverage metric in Chapter 12, which divides inventory assets with required logs by inventory assets, and treats the queries as liveness checks on top of it.

Part 4: the Microsoft 365 unified audit log

The unified audit log covers Exchange Online, SharePoint, OneDrive, Microsoft Entra ID, Teams, Power BI and other Microsoft 365 services.42 It is the plane most often assumed rather than checked.

Step 1: confirm auditing is on

Microsoft says audit logging is on by default for Microsoft 365 organizations but tells administrators to verify it. It isn’t on by default for Small and Medium Business licenses (Business Basic, Standard and Premium) or for unmanaged tenants on enterprise free trials.43 Check in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True means auditing is on.44

WarningRun it in Exchange Online PowerShell, not Security & Compliance PowerShell

Get-AdminAuditLogConfig exists in both modules, but in Security & Compliance PowerShell the UnifiedAuditLogIngestionEnabled property “is always False, even when auditing is turned on.”45 An operator or an automated check that runs it in the wrong session records a finding against a compliant tenant. The program’s check script connects with Connect-ExchangeOnline and records the module in its output.

Step 2: turn it on if needed

In the Microsoft Purview portal, open the Audit solution and select the Start recording user and admin activity banner; or, in Exchange Online PowerShell:

Connect-ExchangeOnline
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

The change can take up to 60 minutes to take effect, and events can take several more hours to become searchable. The operator needs the Audit Logs role in Exchange Online, which the Compliance Management and Organization Management role groups hold by default.46

ImportantTurning auditing off blinds everything downstream

With auditing off, neither the Office 365 Management Activity API nor Microsoft Sentinel can reach audit data, Purview audit searches return nothing, and Search-UnifiedAuditLog returns nothing.47 Changes to the auditing status are themselves recorded, with the time, the administrator and the IP address,48 and the program treats Set-AdminAuditLogConfig as a high-severity detection: disabling tenant auditing is one of the few actions that destroys the record of everything after it. The tenant-side check:

Search-UnifiedAuditLog -Operations Set-AdminAuditLogConfig `
  -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
  -SessionCommand ReturnLargeSet

Search-UnifiedAuditLog returns 100 records by default, so an investigation that needs more uses -SessionCommand ReturnLargeSet, which pages to 50,000 unsorted results.49 Microsoft recommends the Management Activity API, not this cmdlet, for programmatic download of audit data.50

Step 3: register the collector

The Management Activity API relies on Entra ID and OAuth2; the collector is an app registered in the tenant with the Office 365 Management APIs permission Read activity data for your organization, which grants the ActivityFeed.Read claim every call must carry.5152 Most collectors use the client-credentials flow.53 The API host depends on the Microsoft 365 plan:54

Plan API root Entra ID authority
Enterprise (commercial) https://manage.office.com login.microsoftonline.com
GCC https://manage-gcc.office.com login.microsoftonline.com
GCC High https://manage.office365.us login.microsoftonline.us
DoD https://manage.protection.apps.mil login.microsoftonline.us

GCC tenants sit in commercial Entra ID and GCC High and DoD tenants in Azure Government’s,55 which is where the authority column comes from.56 The source page listed login.windows.net for GCC; the program uses login.microsoftonline.com, the commercial authority Microsoft documents.

NoteGCC differs here even though it matches worldwide elsewhere

In GCC, Microsoft Graph and the Azure portal use the worldwide endpoints.57 The Management Activity API does not: GCC has its own manage-gcc.office.com host.58 A collector that authenticates and calls Graph successfully, and then points at manage.office.com, fails on this API, and because the Graph calls worked, the cloud mismatch is the last thing anyone suspects.

Step 4: subscribe to the content types

The API has no per-event selection. A collector subscribes, per tenant, to content types:59

Content type Contents
Audit.AzureActiveDirectory Entra ID events as recorded in the unified audit log
Audit.Exchange Exchange events
Audit.SharePoint SharePoint (and OneDrive) events
Audit.General All other workloads, including Teams60
DLP.All Data loss prevention events for all workloads

DLP sensitive data in the feed is visible only to callers granted the Read DLP sensitive data permission.61

# $headerParams holds an Authorization header with a token for the API root.
$tenantGuid = '<tenant-guid>'
$publisher  = '<tenant-guid>'                     # in-house collector: the agency's own tenant GUID
$resource   = 'https://manage-gcc.office.com'     # GCC; see the endpoint table

foreach ($contentType in 'Audit.AzureActiveDirectory', 'Audit.Exchange',
                         'Audit.SharePoint', 'Audit.General', 'DLP.All') {
    Invoke-RestMethod -Method Post -Headers $headerParams `
      -Uri "$resource/api/v1.0/$tenantGuid/activity/feed/subscriptions/start?contentType=$contentType&PublisherIdentifier=$publisher"
    Start-Sleep -Seconds 900   # 15-minute wait between start requests
}

# Confirm what is subscribed.
Invoke-RestMethod -Method Get -Headers $headerParams `
  -Uri "$resource/api/v1.0/$tenantGuid/activity/feed/subscriptions/list?PublisherIdentifier=$publisher"

PublisherIdentifier is the tenant GUID of the organization that wrote the collector, not the app ID. For an agency’s own collector that is its own tenant GUID; for a vendor product it is the vendor’s. Requests without it share one global throttling quota with every other caller who omitted it, and Microsoft says it belongs on every production call, including the GET for each content blob.6263

Step 5: list and retrieve content

Invoke-RestMethod -Method Get -Headers $headerParams `
  -Uri "$resource/api/v1.0/$tenantGuid/activity/feed/subscriptions/content?contentType=Audit.AzureActiveDirectory&startTime=2026-10-20T00:00&endTime=2026-10-21T00:00&PublisherIdentifier=$publisher"

The rules, all from Microsoft’s API reference and FAQ:6465

  • startTime and endTime must both be given or both omitted, no more than 24 hours apart, with the start no more than seven days in the past. Results for a longer span “could be partial results and should not be taken into account.”
  • The times select content by when it became available (contentCreated), not by when the events happened. There is no way to ask the API for events that occurred in a given period.
  • Results are paged. Keep following the NextPageUri response header until a response arrives without one.
  • Content can be fetched for seven days after it becomes available. A collector outage longer than that is a permanent gap.
  • Stopping a subscription loses whatever became available while it was stopped; restarting doesn’t recover it.
  • Webhooks are optional and Microsoft is de-emphasizing them; polling the /content operation is the simpler design, and Microsoft reports that webhook notifications have lately been slower than polling.
Top to bottom, four cards joined by arrows. First, blue, once per content type: start subscription, waiting 15 minutes between start requests, with first content possibly taking up to 12 hours. Second, blue, every run: list available content in a window of 24 hours or less by availability time, following NextPageUri to the end. Third, blue: fetch each blob within 7 days of availability, with PublisherIdentifier on every call. Fourth, green: deduplicate on contentId and record Id and write to the workspace. A dashed violet arrow loops from the fourth card back to the listing step, labeled re-list a trailing window because events arrive out of order. A dashed red arrow from the fetch step leads to a red pill: outage over 7 days is a permanent gap.
Figure 2: The collector loop: start each subscription once, then list, fetch and deduplicate on every run, re-listing a trailing window because content arrives out of order.
WarningTwo timing rules that break first-time collectors

After a subscription-start request, wait 15 minutes before making another; stopping a subscription isn’t throttled. And after a subscription is created, “it can take up to 12 hours for the first content blobs to become available.”66 A team that starts all five subscriptions in a tight loop and declares failure an hour later has hit both rules at once.

Once flowing, there is still no latency guarantee. Microsoft says most notifications go out within an hour, core services (Exchange, SharePoint, OneDrive, Teams) typically appear in 60 to 90 minutes, and it prioritizes completeness over latency without committing to a delivery time.67

ImportantEvents are not in order, and duplicates are by design

Content blobs are aggregated across many servers and datacenters, so events “will not necessarily appear in the order in which they occurred,” and a blob can contain events older than those in an earlier blob.68 Separately, the audit service may write the same event twice when it retries after an error, and the API, unlike the Purview export, doesn’t remove the duplicates; Microsoft makes that the SIEM’s job.69

A collector that uses “last blob retrieved” or “latest event time” as its high-water mark will drop events. The program’s collector tracks each contentId it has fetched, deduplicates records on the audit record Id,70 and re-lists a trailing window of content on every run.

Retention: the tier that decides the evidence

Turning on the unified audit log doesn’t by itself meet M-26-14’s baseline of six months searchable and a year retrievable.71 How long Microsoft keeps each record depends on the license of the user who performed the activity and on audit retention policies:

Tier Retention
Audit (Standard) 180 days for records generated on or after October 17, 2023 (90 days for older records)72
Audit (Premium), default policy One year for records whose workload is Microsoft Entra ID, Exchange, OneDrive or SharePoint; the policy can’t be modified73
Audit (Premium), other workloads 180 days unless a custom audit retention policy sets longer74
Audit (Premium) plus the 10-Year Audit Log Retention add-on Up to 10 years, per licensed user, under a policy that selects it7576
Non-user entities (service principals, system events, application activity) A fixed one year, not configurable; custom policies don’t apply77

Audit (Premium) comes with Microsoft 365 or Office 365 E5 and G5, the Microsoft Purview Suite, and the E5/G5 eDiscovery and Audit add-ons.78 In GCC and GCC High, Microsoft lists Audit (Standard), Audit (Premium), one-year log retention, the 10-year retention option and increased Management Activity API bandwidth as available.7980

WarningRetention follows the user’s license, not the tenant’s

The one-year default applies only to activity by users with an E5-level license (Office 365 or Microsoft 365 E5, Microsoft Purview Suite, or the E5 eDiscovery and Audit add-on): “If you have non-E5 users or guest users in your organization, their corresponding audit records are retained for 180 days.”81 Federal tenants are rarely uniformly licensed, so most have a split retention horizon that no dashboard shows: licensed users at a year, everyone else, including every guest, at 180 days.

Three more rules from the same page. Custom policies take priority over the default, so a custom policy with a shorter duration for a workload shortens retention for licensed users too. Retaining a record longer than 180 days requires the acting user to hold the license; without it, the highest-priority policy that does apply wins. And changes aren’t retroactive: a policy created today doesn’t extend records already committed.82

The program’s position is that the Purview retention tier is not the evidence store. The Management Activity API collector writes every record to the agency’s own workspace, where table retention is set to the M-26-14 baseline as in Chapter 03, and the licensing map is recorded in the system security plan as a known split rather than discovered during an incident. The workspace’s table retention is also where the program answers AU-4, Audit Log Storage Capacity, which asks for audit log storage capacity allocated to accommodate the retention requirements;83 Chapter 12 sets out the tiers.

Microsoft Sentinel ingestion

For Microsoft Sentinel, the Microsoft 365 (formerly Office 365) connector ingests Exchange, SharePoint and Teams activity into the OfficeActivity table, with no custom client.84 Those three data types are free to ingest.85 The connector is generally available for GCC (on commercial Azure) and for GCC High and DoD (on Azure Government).86 It doesn’t cover every workload in the unified audit log, so the program runs both: the connector for SOC detections on the three core workloads, and a Management Activity API collector for the full feed, including Audit.General and DLP.All, with the provenance the evidence contract in Chapter 02 requires.

Verify Microsoft 365 emission

In the workspace:

// Unified audit emission health by workload.
OfficeActivity
| where TimeGenerated > ago(24h)
| summarize Events = count(), LastEvent = max(TimeGenerated) by OfficeWorkload, RecordType
| extend Stale = LastEvent < ago(6h)
| order by Stale desc, Events desc

OfficeWorkload and RecordType are documented OfficeActivity columns.87 In the tenant, independent of any SIEM:

# Does the unified audit log itself hold recent records for each record type?
Connect-ExchangeOnline
foreach ($rt in 'AzureActiveDirectory', 'ExchangeAdmin', 'ExchangeItem',
                'SharePointFileOperation', 'MicrosoftTeams') {
    $n = @(Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) `
             -RecordType $rt -ResultSize 1).Count
    '{0,-24} {1}' -f $rt, $(if ($n -gt 0) { 'OK' } else { 'NO RECORDS' })
}

The record types are values of AuditLogRecordType.88 The source script used Exchange and SharePoint; Exchange isn’t a record type (Exchange activity is ExchangeAdmin, ExchangeItem or ExchangeItemGroup), and file activity is SharePointFileOperation. Run both checks. The workspace query shows the SIEM is receiving; the tenant check shows the tenant is recording. Only the second one can tell “nothing happened” from “nothing is being captured.”

Control states, rollout and evidence

The chapter has two procedures: Azure emission (Parts 1 to 3) and Microsoft 365 audit collection (Part 4). This section applies Book 00, Appendix D’s conventions to both, reusing what the parts already say.

Authority: Mandated for the retention floor (OMB M-26-14, Retention: the tier that decides the evidence). Microsoft-recommended for verifying that unified auditing is on and for using the Management Activity API rather than Search-UnifiedAuditLog for programmatic collection (Learn pages cited above, read Oct 21, 2026), and for staging policy assignments with DoNotEnforce before enforcing them.89 Risk-based recommended for enabling all eight activity log categories, the allLogs initiative at the top management group, and running both the Sentinel connector and the API collector, which are the program’s design. Applies: All Azure subscriptions and Microsoft 365 tenants. License-dependent: audit retention beyond 180 days follows each user’s license (the warning above). Environment-dependent: the Management Activity API host by plan (Step 3); the Microsoft 365 connector is GA in GCC, GCC High and DoD.

Control states.

State This page Evidence
Designed The category choices in Parts 1 and 2, the policy assignments in Part 3, and the content-type list in Step 4 The program’s logging design in the repository and the Agency Logging Plan
Configured Subscription diagnostic settings; the policy assignments in audit mode; UnifiedAuditLogIngestionEnabled True; the collector’s subscriptions The policy assignment export; the Get-AdminAuditLogConfig output recorded with its module; the subscription list from Step 4
Enforced Part 3: the allLogs initiative and the activity log policy assigned with enforcement on, and a remediation task run per policy The assignment’s enforcementMode Default; remediation task results; the policy exemptions list
Evidenced Verify Azure emission and Verify Microsoft 365 emission The query and script outputs, with the subscription check showing no NO ACTIVITY LOG EXPORT line
Operated Policy compliance against the inventory as the coverage input to Chapter 12; the high-severity detection on Set-AdminAuditLogConfig Compliance history; the detection’s alert history; the collector’s run log

A finding this page addresses is ready for closure when every applicable state has evidence; the authorizing official or assessor decides.

How-section coverage

Subsection Azure emission (Parts 1 to 3) Microsoft 365 audit (Part 4)
Prerequisites The roles in each part; the remediation identity’s roles (Where DeployIfNotExists stops) The Audit Logs role; the collector’s app registration and ActivityFeed.Read; the plan’s API host
Pilot One non-production subscription, then one management group below the root A test tenant, or the production tenant read-only before the collector writes anywhere
Report-only or audit phase AuditIfNotExists, or DeployIfNotExists with enforcementMode DoNotEnforce, until the first evaluation is read90 Not applicable: reading the audit log changes nothing
Enforcement enforcementMode Default, ring by ring (below), then a remediation task per policy Step 2 turns auditing on where it was off; nothing else enforces
Rollback Set the assignment back to DoNotEnforce; diagnostic settings already deployed stay and are removed only by change Stop the collector; never turn tenant auditing off (it blinds everything downstream)
Exclusions The logging storage accounts and event hubs (the self-reference loop); resource types outside the initiative, each with a documented exception None for auditing; split retention by license is recorded in the system security plan
Telemetry The Policy activity log category; compliance state; the queries above OfficeActivity; the collector’s contentId log; the audit record of any Set-AdminAuditLogConfig
Evidence The checklist below The checklist below
Day-two ownership Platform engineering owns the assignments; security engineering owns the category list (Chapter 10) Security engineering owns the collector; the SOC owns the auditing-disabled detection

Change safety (Part 3, the only step here that enforces)

Ring Scope Exit criteria
0 A sandbox subscription Assignment deploys; first evaluation completes; one remediation task succeeds
1 One non-production management group Compliant count matches the inventory; no failed remediation deployments
2 Production management groups except Tier 0 platform subscriptions No deployment failures attributed to the policy for one week
3 The top management group Compliance against the full inventory reported in Chapter 12
  • Emergency access: not applicable to sign-in; the policies change no access. The remediation identity’s role assignments are reviewed with the other privileged roles (Book 04).
  • Change window: the platform team’s standard window, approved through change control; the platform engineer on hand.
  • Backout triggers: a remediation deployment fails on a production resource, or a resource’s own logging destination loops; set back to DoNotEnforce and fix before going on.
  • Post-change validation: the subscription check and the AzureDiagnostics backlog query after each ring.

Evidence checklist

NoteAssessment mapping
  • Microsoft Zero Trust pillar: SecOps; Infrastructure for the Azure planes
  • CISA ZTMM pillar: Applications and Workloads, and the Visibility and Analytics cross-cutting capability
  • Depends on: the identity telemetry in Chapter 03; the workspace retention in Chapter 12; Purview audit depth in Book 20, Chapter 10
  • Attack chain interrupted: Defense Evasion (turning tenant auditing off, or a resource born without logging); Collection and Exfiltration in mailboxes and sites stay visible

Where the evidence goes next

All three emission paths now land in one workspace, with one verification loop and retention set to the baseline. Chapter 05 turns these tables into detections, and Chapter 12 turns the coverage and liveness checks into continuous-monitoring evidence. The control-level detail for SIEM and detection is in Vol III Book 06.

TipContinue the book

← Previous: Chapter 03 — Identity Telemetry from Entra ID · Book index · Next: Chapter 05 — From Log Warehouse to Detection: SIEM and XDR →

  1. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  2. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  3. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  4. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  5. Microsoft Learn, “Azure Activity Log event schema,” section “Categories,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log-schema (accessed Oct 21, 2026).↩︎

  6. Microsoft Learn, “Azure Activity Log event schema,” section “Categories,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log-schema (accessed Oct 21, 2026).↩︎

  7. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, controls AC-2 and AC-6 (OSCAL catalog release 5.2.0), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed Oct 21, 2026); AU-4 from the same catalog (accessed Nov 9, 2026).↩︎

  8. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  9. Microsoft Learn, Azure CLI reference, “az monitor diagnostic-settings subscription,” https://learn.microsoft.com/cli/azure/monitor/diagnostic-settings/subscription (accessed Oct 21, 2026).↩︎

  10. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  11. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  12. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  13. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  14. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  15. Microsoft Learn, “Resource logs in Azure Monitor,” sections “Collecting resource logs” and “Collection mode,” https://learn.microsoft.com/azure/azure-monitor/logs/resource-logs (accessed Oct 21, 2026).↩︎

  16. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  17. Microsoft Learn, “Resource logs in Azure Monitor,” sections “Collecting resource logs” and “Collection mode,” https://learn.microsoft.com/azure/azure-monitor/logs/resource-logs (accessed Oct 21, 2026).↩︎

  18. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  19. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  20. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  21. Microsoft Learn, “Resource logs in Azure Monitor,” sections “Collecting resource logs” and “Collection mode,” https://learn.microsoft.com/azure/azure-monitor/logs/resource-logs (accessed Oct 21, 2026).↩︎

  22. Microsoft Learn, “Resource logs in Azure Monitor,” sections “Collecting resource logs” and “Collection mode,” https://learn.microsoft.com/azure/azure-monitor/logs/resource-logs (accessed Oct 21, 2026).↩︎

  23. Microsoft Learn, Azure Monitor Logs table reference, “AzureDiagnostics,” section “AdditionalFields column,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics (accessed Oct 21, 2026).↩︎

  24. Microsoft Learn, Azure Monitor Logs table reference, “AzureDiagnostics,” section “AdditionalFields column,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics (accessed Oct 21, 2026).↩︎

  25. Microsoft Learn, Azure Monitor Logs table reference, “AzureDiagnostics,” section “AdditionalFields column,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics (accessed Oct 21, 2026).↩︎

  26. Microsoft Learn, “Resource logs in Azure Monitor,” sections “Collecting resource logs” and “Collection mode,” https://learn.microsoft.com/azure/azure-monitor/logs/resource-logs (accessed Oct 21, 2026).↩︎

  27. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  28. Microsoft Learn, “Diagnostic settings in Azure Monitor,” sections “Destinations,” “Methods for creating a diagnostic setting” (PowerShell and CLI tabs, and the self-reference warning) and “Category groups,” and the opening warning on deleted or moved resources, https://learn.microsoft.com/azure/azure-monitor/platform/diagnostic-settings (accessed Oct 21, 2026).↩︎

  29. Microsoft Learn, “Azure Policy built-in definitions for Azure Monitor,” https://learn.microsoft.com/azure/azure-monitor/fundamentals/policy-reference (accessed Oct 21, 2026).↩︎

  30. Microsoft Learn, “Azure Policy built-in initiative definitions,” section “Monitoring,” https://learn.microsoft.com/azure/governance/policy/samples/built-in-initiatives (accessed Oct 21, 2026).↩︎

  31. Microsoft Learn, “Azure Policy built-in initiative definitions,” section “Monitoring,” https://learn.microsoft.com/azure/governance/policy/samples/built-in-initiatives (accessed Oct 21, 2026).↩︎

  32. Microsoft Learn, “Azure Policy built-in policy definitions,” section “Monitoring,” https://learn.microsoft.com/azure/governance/policy/samples/built-in-policies (accessed Oct 21, 2026).↩︎

  33. Microsoft Learn, “Azure Policy definitions deployIfNotExists effect,” sections “DeployIfNotExists evaluation” and “DeployIfNotExists properties” (evaluationDelay, roleDefinitionIds), https://learn.microsoft.com/azure/governance/policy/concepts/effect-deploy-if-not-exists (accessed Oct 21, 2026).↩︎

  34. Microsoft Learn, “Azure Policy definitions deployIfNotExists effect,” sections “DeployIfNotExists evaluation” and “DeployIfNotExists properties” (evaluationDelay, roleDefinitionIds), https://learn.microsoft.com/azure/governance/policy/concepts/effect-deploy-if-not-exists (accessed Oct 21, 2026).↩︎

  35. Microsoft Learn, “Remediate non-compliant resources with Azure Policy,” sections “How remediation access control works,” “Grant permissions to the managed identity through defined roles” and “Create a remediation task,” https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources (accessed Oct 21, 2026).↩︎

  36. Microsoft Learn, “Remediate non-compliant resources with Azure Policy,” sections “How remediation access control works,” “Grant permissions to the managed identity through defined roles” and “Create a remediation task,” https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources (accessed Oct 21, 2026).↩︎

  37. Microsoft Learn, “Remediate non-compliant resources with Azure Policy,” sections “How remediation access control works,” “Grant permissions to the managed identity through defined roles” and “Create a remediation task,” https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources (accessed Oct 21, 2026).↩︎

  38. Microsoft Learn, “Remediate non-compliant resources with Azure Policy,” sections “How remediation access control works,” “Grant permissions to the managed identity through defined roles” and “Create a remediation task,” https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources (accessed Oct 21, 2026).↩︎

  39. FedRAMP, FedRAMP Consolidated Rules for 2026, Key Security Indicators, “Monitoring, Logging, and Auditing” (KSI-MLA-EVC, KSI-MLA-LET), https://www.fedramp.gov/2026/providers/20x/key-security-indicators/monitoring-logging-and-auditing/ (accessed Oct 21, 2026).↩︎

  40. Microsoft Learn, Azure Monitor Logs table reference, “AzureActivity,” section “Columns,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/azureactivity (accessed Oct 21, 2026).↩︎

  41. Microsoft Learn, “Activity log in Azure Monitor,” sections “Activity log entries,” “Retention period,” “Export activity log,” “Export management group activity logs” and “Identify resource creation,” https://learn.microsoft.com/azure/azure-monitor/platform/activity-log (accessed Oct 21, 2026).↩︎

  42. Microsoft Learn, Exchange PowerShell reference, “Search-UnifiedAuditLog,” description and parameters ResultSize and SessionCommand, https://learn.microsoft.com/powershell/module/exchangepowershell/search-unifiedauditlog (accessed Oct 21, 2026).↩︎

  43. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  44. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  45. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  46. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  47. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  48. Microsoft Learn, “Turn auditing on or off,” sections “Before you turn auditing on or off,” “Verify the auditing status for your organization,” “Turn on auditing” and “Audit records when auditing status is changed,” https://learn.microsoft.com/purview/audit-log-enable-disable (accessed Oct 21, 2026).↩︎

  49. Microsoft Learn, Exchange PowerShell reference, “Search-UnifiedAuditLog,” description and parameters ResultSize and SessionCommand, https://learn.microsoft.com/powershell/module/exchangepowershell/search-unifiedauditlog (accessed Oct 21, 2026).↩︎

  50. Microsoft Learn, Exchange PowerShell reference, “Search-UnifiedAuditLog,” description and parameters ResultSize and SessionCommand, https://learn.microsoft.com/powershell/module/exchangepowershell/search-unifiedauditlog (accessed Oct 21, 2026).↩︎

  51. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  52. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  53. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  54. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  55. Microsoft Learn, “Cloud feature availability for US Government customers,” sections “Microsoft 365 integration” and “Microsoft Sentinel” (Office 365 connector), https://learn.microsoft.com/azure/security/fundamentals/feature-availability (accessed Oct 21, 2026).↩︎

  56. Microsoft Learn, “Microsoft Graph national cloud deployments,” sections “App registration and token service root endpoints” and “Microsoft Graph and Graph Explorer service root endpoints,” https://learn.microsoft.com/graph/deployments (accessed Oct 21, 2026).↩︎

  57. Microsoft Learn, “Microsoft Graph national cloud deployments,” sections “App registration and token service root endpoints” and “Microsoft Graph and Graph Explorer service root endpoints,” https://learn.microsoft.com/graph/deployments (accessed Oct 21, 2026).↩︎

  58. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  59. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  60. Microsoft Learn, “Microsoft Sentinel and Microsoft Teams,” step 1 (“Teams data is collected in the Microsoft 365 audit under Audit.General”), https://learn.microsoft.com/microsoftteams/teams-sentinel-guide (accessed Oct 21, 2026).↩︎

  61. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  62. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  63. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  64. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  65. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  66. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  67. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  68. Microsoft Learn, “Office 365 Management Activity API reference,” sections “Working with the Office 365 Management Activity API,” “Activity API operations,” “Start a subscription,” “Stop a subscription,” “List available content” and “Pagination,” https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference (accessed Oct 21, 2026).↩︎

  69. Microsoft Learn, “Office 365 Management Activity API FAQs and troubleshooting,” frequently asked questions (latency, content availability, duplicates) and sections “Connect to the API,” “Check content availability,” “Use webhooks” and “Request content blobs and throttling,” https://learn.microsoft.com/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api (accessed Oct 21, 2026).↩︎

  70. Microsoft Learn, “Office 365 Management Activity API schema,” section “Common schema” (Id property and AuditLogRecordType enumeration), https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-schema (accessed Oct 21, 2026).↩︎

  71. Office of Management and Budget, M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026, Appendix B, item 1, https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf (accessed Oct 21, 2026).↩︎

  72. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  73. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  74. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  75. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  76. Microsoft Learn, “Learn about auditing solutions in Microsoft Purview,” sections “Comparison of key capabilities” (note 2) and “Audit (Premium),” https://learn.microsoft.com/purview/audit-solutions-overview (accessed Oct 21, 2026).↩︎

  77. Microsoft Learn, “Learn about auditing solutions in Microsoft Purview,” sections “Comparison of key capabilities” (note 2) and “Audit (Premium),” https://learn.microsoft.com/purview/audit-solutions-overview (accessed Oct 21, 2026).↩︎

  78. Microsoft Learn, “Microsoft Purview service description,” section “Microsoft Purview Audit (Premium),” https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description (accessed Oct 21, 2026).↩︎

  79. Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” step 4 (Audit (Standard) and Audit (Premium) rows), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Oct 21, 2026).↩︎

  80. Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” step 4 (Audit (Standard) and Audit (Premium) rows), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Oct 21, 2026).↩︎

  81. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  82. Microsoft Learn, “Manage audit log retention policies,” sections “Default audit log retention policy in Audit (Premium)” and “Before you create an audit log retention policy,” https://learn.microsoft.com/purview/audit-log-retention-policies (accessed Oct 21, 2026).↩︎

  83. National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, controls AC-2 and AC-6 (OSCAL catalog release 5.2.0), https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed Oct 21, 2026); AU-4 from the same catalog (accessed Nov 9, 2026).↩︎

  84. Microsoft Learn, Azure Monitor Logs table reference, “OfficeActivity,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/officeactivity (accessed Oct 21, 2026).↩︎

  85. Microsoft Learn, “Plan costs and understand Microsoft Sentinel pricing and billing,” section “Free data sources,” https://learn.microsoft.com/azure/sentinel/billing (accessed Oct 21, 2026).↩︎

  86. Microsoft Learn, “Cloud feature availability for US Government customers,” sections “Microsoft 365 integration” and “Microsoft Sentinel” (Office 365 connector), https://learn.microsoft.com/azure/security/fundamentals/feature-availability (accessed Oct 21, 2026).↩︎

  87. Microsoft Learn, Azure Monitor Logs table reference, “OfficeActivity,” https://learn.microsoft.com/azure/azure-monitor/reference/tables/officeactivity (accessed Oct 21, 2026).↩︎

  88. Microsoft Learn, “Office 365 Management Activity API schema,” section “Common schema” (Id property and AuditLogRecordType enumeration), https://learn.microsoft.com/office/office-365-management-api/office-365-management-activity-api-schema (accessed Oct 21, 2026).↩︎

  89. Microsoft Learn, “Safe deployment of Azure Policy assignments,” section “Steps for safe deployment of Azure Policy assignments with modify or deployIfNotExists effects” (assign with enforcementMode DoNotEnforce, validate compliance, then set Default tier by tier), https://learn.microsoft.com/azure/governance/policy/how-to/policy-safe-deployment-practices, and “Azure Policy assignment structure,” section “Enforcement mode,” https://learn.microsoft.com/azure/governance/policy/concepts/assignment-structure#enforcement-mode (both accessed Nov 11, 2026).↩︎

  90. Microsoft Learn, “Safe deployment of Azure Policy assignments,” section “Steps for safe deployment of Azure Policy assignments with modify or deployIfNotExists effects” (assign with enforcementMode DoNotEnforce, validate compliance, then set Default tier by tier), https://learn.microsoft.com/azure/governance/policy/how-to/policy-safe-deployment-practices, and “Azure Policy assignment structure,” section “Enforcement mode,” https://learn.microsoft.com/azure/governance/policy/concepts/assignment-structure#enforcement-mode (both accessed Nov 11, 2026).↩︎

Back to top