Advanced Audit in Microsoft 365

Microsoft 365 generates audit records for thousands of operations across Exchange Online, SharePoint Online, Azure Active Directory, Microsoft Teams, Power BI, and other workloads. By default, all Microsoft 365 tenants have basic audit logging enabled, which retains audit records for 90 days (or 180 days for Exchange mailboxes). However, many organizations — especially those in regulated industries like finance, healthcare, or government — need to retain audit data for years to satisfy compliance requirements such as SEC Rule 17a-4, HIPAA, or GDPR. Advanced Audit is a premium add-on that extends retention, provides intelligent insights, and offers programmatic access to audit data.

Advanced Audit is licensed per user via one of the following:

Without Advanced Audit, the maximum retention for audit records is 90 days (standard audit). With Advanced Audit, you can retain audit records for up to 10 years, depending on the license and configuration.

When a user performs an action in a Microsoft 365 workload — for example, a user downloads a file from SharePoint — the service generates an audit record. This record contains: - CreationTime: UTC timestamp of the action - Operation: The action performed (e.g., FileDownloaded) - UserId: The user who performed the action - ClientIP: The IP address of the client - ItemId: The unique identifier of the object acted upon - ItemType: The type of object (e.g., File, Folder, Mailbox) - Workload: The service where the action occurred (e.g., SharePoint, Exchange) - ResultStatus: Success or Failure - Additional properties: Varies by workload (e.g., file name, size, destination)

These records are ingested into the Unified Audit Log (UAL) in the Microsoft 365 backend. The UAL is an append-only store with no modification or deletion capabilities — not even by Microsoft administrators. Records are indexed for search and automatically purged based on the retention policy.

With Advanced Audit: - Retention Policies: You can assign retention policies to audit records based on the workload or activity type. For example, you can retain all SharePoint audit records for 10 years, while Exchange admin actions are retained for 5 years. Retention is enforced by a background service that checks the age of records against the policy and deletes expired records. - Bandwidth Throttling: Standard audit logs are subject to throttling limits — up to 2,000 requests per tenant per day for the AuditLog.Search API. Advanced Audit raises this limit to 20,000 requests per day, allowing large-scale continuous export. - Intelligent Insights: Advanced Audit includes heuristic-based alerts for suspicious activities, such as unusual volume of file downloads or access from anomalous locations. - Programmatic Access: The AuditLog.Search API and the Search-UnifiedAuditLog PowerShell cmdlet can retrieve audit records with higher throughput and longer lookback windows.

Audit Record Retention Defaults: - Standard audit (no Advanced Audit): 90 days for all workloads except Exchange mailbox audits (180 days) - Advanced Audit with E5 license: 1 year default, can be extended to 10 years with retention policies - Licensing: Each user must have an Advanced Audit license to generate audit records that can be retained beyond 90 days. If a user does not have an Advanced Audit license, their records are still generated but retained only for 90 days.

Bandwidth Throttling: - Default limit for AuditLog.Search API: 2,000 requests per tenant per day - With Advanced Audit: 20,000 requests per tenant per day - PowerShell: Search-UnifiedAuditLog has a default page size of 100 records (max 5,000). Advanced Audit allows up to 5,000 records per page with the -ResultSize parameter.

Retention Policies: - You can create up to 100 audit retention policies per tenant - Each policy applies to specific activities (e.g., SharePoint file access, Exchange admin actions) or workloads - Retention duration can be 90 days, 1 year, 5 years, or 10 years - Policies are evaluated every 7 days to purge expired records

Intelligent Insights: - Use Cases: Detecting unusual volume of file downloads, access from anonymous IPs, or mass deletion of documents - Alerts are surfaced in the Microsoft 365 Defender portal under Incidents & Alerts - These do not require additional configuration — they are automatically enabled when Advanced Audit is licensed

To enable Advanced Audit, you must first assign licenses to users. Then, verify the license assignment using PowerShell:

Get-MsolUser -UserPrincipalName user@contoso.com | Select-Object Licenses

To check the current audit retention policy:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

To create a custom audit retention policy for 10 years for SharePoint operations:

New-AuditConfigurationPolicy -Name "SharePoint 10-Year Retention" -Workload SharePoint -RetentionDuration 10 -RetentionType Years

To search the audit log with Advanced Audit (higher throughput):

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -ResultSize 5000 -Operations FileDownloaded

To verify Advanced Audit is enabled on the tenant:

Get-AdminAuditLogConfig | Format-List *Audit*

Look for UnifiedAuditLogIngestionEnabled : True and AdvancedAuditEnabled : True.

Advanced Audit integrates with: - Microsoft 365 Compliance Center: The Audit log search interface is the primary UI for querying audit records. Advanced Audit provides additional filters and longer date ranges. - Microsoft 365 Defender: Alerts from Intelligent Insights appear in the Defender portal, correlating audit events with other security signals. - eDiscovery: Audit records are used to prove chain of custody in eDiscovery cases. Advanced Audit ensures records are retained for the duration of litigation holds. - Microsoft Graph API: The AuditLog.Query API allows programmatic access with advanced throttling limits. - Data Lifecycle Management: Retention policies for audit logs are managed alongside other retention policies in the Compliance Center.

Common exam traps: - Trap 1: "Advanced Audit extends retention to 10 years for all records by default." Reality: Default retention is 1 year; you must create a retention policy for 10-year retention. - Trap 2: "Audit records can be edited or deleted by administrators." Reality: Audit records are immutable. - Trap 3: "Advanced Audit requires an E3 license." Reality: Advanced Audit requires E5 or add-on; E3 only includes standard audit. - Trap 4: "Audit log search is limited to 90 days even with Advanced Audit." Reality: Advanced Audit allows search up to 10 years back, depending on retention policy. - Trap 5: "All users automatically get Advanced Audit benefits if the tenant has one E5 license." Reality: Each user must be licensed individually.

Scenario 1: Financial Services Compliance A global investment bank must retain all user and admin activity logs for 7 years per SEC Rule 17a-4. They deploy Advanced Audit for all 10,000 employees with Microsoft 365 E5 licenses. The compliance team creates a retention policy for 10 years (to be safe) covering all workloads. They use the AuditLog.Search API to continuously export logs to a SIEM system (Splunk) for real-time monitoring. The API throttling limit of 20,000 requests per day allows them to pull incremental data every hour. Without Advanced Audit, the 90-day retention would violate regulatory requirements. One challenge they face is managing the 100-policy limit — they consolidate policies by workload rather than by individual activity. Misconfiguration example: If they forget to assign licenses to new hires, those users' audit records are purged after 90 days, creating a compliance gap.

Scenario 2: Insider Threat Investigation A technology company suspects an employee of stealing intellectual property by downloading thousands of files from SharePoint. With Advanced Audit, they use Intelligent Insights to detect the anomalous download volume. The alert triggers an investigation in Microsoft 365 Defender. The security team uses the Audit Log Search to filter by UserId and Operation (FileDownloaded) for the past 6 months, exporting 50,000 records. They analyze the data in Excel and confirm the exfiltration. Advanced Audit's 1-year default retention (extended to 5 years via policy) ensures the evidence is available. Without Advanced Audit, the 90-day retention would have already deleted the oldest records.

Scenario 3: Multi-Geo Tenant Management A multinational corporation with offices in Europe, Asia, and North America uses Microsoft 365 Multi-Geo. Advanced Audit records are stored in the geo-location where the data resides. The compliance team must ensure that audit retention policies are applied uniformly across all geos. They use PowerShell to create policies that target all locations. A common pitfall is assuming that a single retention policy applies globally — in reality, each geo's audit log is independent, and policies must be applied per geo. They also need to consider data sovereignty: audit records for European users must stay within the EU. Advanced Audit supports this by respecting data residency.