CISA.MS.EXO.17.1: Microsoft Purview Audit (Standard) logging SHALL be enabled.
| ID | CISA.MS.EXO.17.1 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.17.1 (SHALL) |
| Framework controls | cisa-scuba:MS.EXO.17.1nist-800-53-r5:AU-12 Audit Record Generation |
| MITRE ATT&CK | T1685.002 |
| Reads from | Exchange Online, Security & Compliance PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Microsoft Purview Audit (Standard) logging SHALL be enabled.
Rationale: Responding to incidents without detailed information about activities that took place slows response actions. Enabling Microsoft Purview Audit (Standard) helps ensure agencies have visibility into user actions. Furthermore, Microsoft Purview Audit (Standard) is required for government agencies by OMB M-21-31 (referred to therein by its former name, Unified Audit Logs).
Remediation action:
Section titled “Remediation action:”To enable auditing via the Microsoft Purview compliance portal:
- Sign in to the Microsoft Purview compliance portal.
- Under Solutions, select Audit.
- If auditing is not enabled, a banner is displayed to notify the administrator to start recording user and admin activity.
- Click the Start recording user and admin activity.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.