CISA.MS.EXO.17.2: Microsoft Purview Audit (Premium) logging SHALL be enabled.
| ID | CISA.MS.EXO.17.2 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Related products | Purview |
| Feature | Audit logging |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.17.2 (SHALL) |
| Framework controls | cisa-scuba:MS.EXO.17.2 |
| Reads from | Microsoft Graph |
| Lifecycle | Deprecated |
What this checks and how to fix it
Section titled “What this checks and how to fix it”This is no longer applicable, and is deprecated by CISA. The content below is retained as a historical archive and will be removed in a future version.
Microsoft Purview Audit (Premium) logging SHALL be enabled.
Rationale: Standard logging may not include relevant details necessary for visibility into user actions during an incident. Enabling Microsoft Purview Audit (Premium) captures additional event types not included with Standard. Furthermore, it is required for government agencies by OMB M-21-13 (referred to therein by its former name, Unified Audit Logs w/Advanced Features).
Remediation action
Section titled “Remediation action”To set up Microsoft Purview Audit (Premium), see Set up Microsoft Purview Audit (Premium) | Microsoft Learn.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.