'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Why Microsoft 365 Unified Audit Log Is Not Enabled by Default and How to Fix It
Question details
The user needs to understand why the Microsoft 365 Unified Audit Log is not activated by default and how to enable it for their specific tenant.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring compliance tracking and auditing policies within a Microsoft 365 organization.
- Observed behavior
- The Unified Audit Log is enabled automatically for certain Enterprise and Education SKUs but requires manual administrator enablement for other Business, Exchange, and frontline plans.
Ensure you have global administrator or compliance administrator privileges in your Microsoft 365 tenant before attempting to view or modify audit log settings.
Enable Unified Audit Log in the Microsoft Purview Portal
Administrators can manually activate the audit log for tenants where it is not turned on by default due to licensing tiers.
Default enablement of the Unified Audit Log depends on your Microsoft 365 subscription SKU. While Enterprise (E1/E3/E5), Education (A1/A3/A5), and Defender plans have it enabled by default, Business and frontline plans often require manual configuration.
Log in to the Microsoft Purview portal (compliance.microsoft.com) using your administrator credentials.
On the left-hand navigation menu, scroll down and click on 'Audit' to open the audit search page.
If auditing is not currently enabled for your tenant, a banner will appear at the top of the page prompting you to 'Start recording user and admin activity'. Click this banner to activate the Unified Audit Log.
Check and Enable Audit Logging via Exchange Online PowerShell
Use PowerShell to quickly verify if the Unified Audit Log is enabled for your tenant and turn it on if necessary.
Manage Your Daily Documents Seamlessly with WPS Office
While configuring Microsoft 365 compliance features requires administrative expertise and specific licenses, managing your everyday documents shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for all your word processing, spreadsheet, and presentation needs.
- 1. Download and Install: Visit the official WPS website to download the free installation package for your operating system.
- 2. Open Your Office Files: Launch WPS Office and open your existing Word, Excel, or PowerPoint files with zero formatting loss.
- 3. Save and Share Securely: Edit your documents and save them in standard Microsoft formats or apply local encryption for secure sharing.
Frequently Asked Questions
Which Microsoft 365 plans have auditing enabled by default?
Common Enterprise (E1/E3/E5), Education (A1/A3/A5), Defender, and specific Government plans have the Unified Audit Log enabled by default. Other SKUs like Business Basic/Standard typically require manual enablement.
How long does it take for audit logging to start working after I enable it?
Once you click 'Start recording user and admin activity' in the Microsoft Purview portal or enable it via PowerShell, it can take up to 60 minutes for the backend preparation to complete and for activities to start appearing in search results.
Why are some user activities missing even after enabling the log?
Default logging does not record every possible activity across the ecosystem. Your tenant's specific licensing tier determines which advanced audit features (such as MailItemsAccessed) are available and how long the log data is retained.
Can I disable the Unified Audit Log later if I change my mind?
Yes, administrators can disable auditing by using Exchange Online PowerShell and running the 'Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false' command.
