MT.1172: Unified audit log ingestion is enabled.
| ID | MT.1172 |
| Severity | High |
| Suite | Mito |
| Product | Purview |
| Feature | Audit |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:AU-12 Audit Record Generation |
| MITRE ATT&CK | T1685.002 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Ensure the Microsoft 365 unified audit log is enabled so tenant activity across Exchange, SharePoint, OneDrive, Teams, Entra ID, Microsoft 365 Copilot and other workloads is captured for Microsoft Purview.
The unified audit log is the foundation for Microsoft Purview Audit, eDiscovery, Insider Risk Management, Communication Compliance, and the DSPM for AI activity explorer. Copilot prompt/response activity is one of many signals that flow into it — along with mailbox access, file operations, admin actions, sign-ins and every other workload event.
When UnifiedAuditLogIngestionEnabled is False:
- Tenant activity is not captured anywhere in Purview.
- Purview audit search returns no results.
- eDiscovery cannot find user or workload activity.
- Insider Risk Management policies cannot generate alerts.
- Communication Compliance policies will not match content.
- DSPM for AI activity explorer will be empty and Copilot interactions cannot be reviewed.
The test passes if Get-AdminAuditLogConfig returns UnifiedAuditLogIngestionEnabled = True.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online PowerShell as a Compliance Administrator or higher:
Connect-ExchangeOnline. - Run:
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. - Allow up to 60 minutes for ingestion to begin and confirm by searching the Microsoft Purview audit search.
Related links
Section titled “Related links”- Microsoft Learn — Turn auditing on or off
- Microsoft Learn — Search the audit log
- Microsoft Learn — Audit logs for Microsoft 365 Copilot interactions
- Microsoft Learn — Data Security Posture Management for AI
Mito check. Author: OfirGavish. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.