Monitoring
Audit logs, alerts and Secure Score in Microsoft 365, explained
Microsoft 365 audit log retention as Microsoft lists it: Audit Standard vs Premium, auditing defaults, alert policies, Entra sign-in logs and Secure Score.
Where to start: Microsoft 365 audit logs and alerts
Records only help if they were being kept before something went wrong. These are the checks Microsoft's documentation points to, with where to find each one.
- Check auditing is turned onMicrosoft says auditing isn't on by default for Business Basic, Standard and Premium. In the Microsoft Purview portal, open the Audit solution; if a banner appears, select 'Start recording user and admin activity'.Steps to turn auditing on
- Know how far back your audit records goMicrosoft lists 180 days for Audit (Standard), which the Business plans and Microsoft 365 E3 include, and one year for key services with Audit (Premium), which Microsoft lists for E5.Audit Standard and Premium compared
- Review the default alert policies and who is notifiedIn the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Alert policy. Microsoft says admins can turn default policies on or off, choose email recipients and set a daily limit.Which alerts Microsoft provides
- Find the Entra sign-in logsIn the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs (at least Reports Reader). Microsoft lists seven days of history with Entra ID Free and 30 days with P1 or P2.Sign-in log retention by licence
- Use Secure Score to find recommended actionsMicrosoft Secure Score is at security.microsoft.com/securescore in the Defender portal. Microsoft says it isn't a guarantee against breach and its recommendations don't cover every attack surface.What Secure Score measures
Based on Microsoft Learn's pages on Purview Audit, turning auditing on, alert policies, Entra sign-in logs and data retention, and Secure Score, checked October 2026. Menus can change; Microsoft's pages have the latest steps.
Key points
- Microsoft says turning auditing on can take up to 60 minutes, and that events might take several hours after that to become searchable.
- Microsoft notes that keeping audit records for 10 years needs a separate add-on licence on top of Audit (Premium).
- Microsoft says its forwarding-rule alert policy only tracks rules created in Outlook on the web or Exchange Online PowerShell.
- Microsoft says that with Entra ID Free, sign-in data collection starts the first time someone opens Microsoft Entra ID or uses the reporting APIs.
When something goes wrong in a Microsoft 365 tenant, such as an account sign-in from somewhere unexpected or a new mail-forwarding rule, the first question is usually “what happened, and when?”. The answer depends on what Microsoft 365 was recording at the time: Microsoft lists 180 days of audit records with Audit (Standard) and one year for key services with Audit (Premium), and says auditing isn’t on by default for Business Basic, Standard and Premium. That matters when responding to a compromised Microsoft 365 account. This guide explains, as Microsoft’s documentation describes them, the audit log, Microsoft 365 audit log retention (how long records are kept), alert policies, Microsoft Entra sign-in logs, and Microsoft Secure Score.
The unified audit log
Microsoft Purview Audit records user and administrator activity across Microsoft 365 services. Microsoft says Audit (Standard) “enables you to log and search for audited activities to support your forensic, IT, compliance, and legal investigations”.
Is auditing on by default?
Microsoft’s “Turn auditing on or off” page says audit logging “is on by default for Microsoft 365 organizations”, and that new organisations should verify the status. It then lists exceptions:
“Auditing isn’t enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium. Additionally, unmanaged tenants that use free trials of enterprise licenses don’t have auditing enabled by default.”
For those cases, Microsoft states that auditing has to be turned on manually. Microsoft also notes that turning it on might take up to 60 minutes to take effect, and that events might take several hours after that to become searchable.
How to turn auditing on
Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s “Turn auditing on or off” page has the latest steps, and also shows how to check the status with Exchange Online PowerShell.
- Sign in to the Microsoft Purview portal with an account that has the Audit Logs role in Exchange Online. (Microsoft says the Compliance Management and Organization Management role groups have this role by default.)
- Select the Audit solution card. If it isn’t shown, select View all solutions, then Audit in the Core section.
- If auditing isn’t turned on, a banner prompts you to start recording. Select Start recording user and admin activity.
Audit (Standard) and Audit (Premium)
Microsoft describes two tiers:
| Audit (Standard) | Audit (Premium) | |
|---|---|---|
| Default retention, per Microsoft | 180 days | One year for Microsoft Entra ID, Exchange, OneDrive and SharePoint records; 180 days for other activity |
| Extras Microsoft describes | Search and export of audited activities | Audit log retention policies, longer retention, “intelligent insights” (such as the MailItemsAccessed event, which records mail items being accessed), and higher bandwidth to the Office 365 Management Activity API |
Microsoft adds that keeping a user’s records for 10 years needs a separate 10-Year Audit Log Retention add-on licence, on top of Audit (Premium) licensing. It also says changes to licensing or retention policies change when audit data expires.
Alert policies
Microsoft describes alert policies as rules that generate alerts in the Microsoft Defender portal “when users perform activities that match the conditions of an alert policy”. Microsoft provides a set of default policies. Examples on its page include:
- Creation of forwarding/redirect rule: an inbox rule that forwards or redirects messages to another email account (Microsoft notes this policy only tracks rules created in Outlook on the web or Exchange Online PowerShell)
- Elevation of Exchange admin privilege: someone being given administrative permissions in Exchange Online (the guide to Microsoft 365 admin roles and least privilege explains admin roles)
- Suspicious email sending patterns detected
- User restricted from sending email.
Microsoft’s table lists which subscriptions each default policy applies to, and these differ from policy to policy. As checked in October 2026, the table lists the first three examples above against “E1/F1/G1, E3/F3/G3, or E5/G5” subscriptions, while User restricted from sending email also lists Microsoft Business Basic, Business Standard and Business Premium. Microsoft also says the ability to base alert policies on a threshold or on unusual activity needs an E5/G5 subscription, or an E1/F1/G1 or E3/F3/G3 subscription with an add-on such as Microsoft Defender for Office 365 P2, Microsoft 365 E5 Compliance or the eDiscovery and Audit add-on. Microsoft says administrators can turn default policies off or on, choose who receives email notifications, and set a daily notification limit. Microsoft’s page says alert policies are found in the Microsoft Defender portal under Email & collaboration > Policies & rules > Alert policy, and the alerts themselves under Incidents & alerts > Alerts.
The guide to suspicious inbox rules in Microsoft 365 explains why forwarding rules matter.
Microsoft Entra sign-in logs
Sign-in logs, kept in Microsoft Entra ID, show who signed in, when and from where. They are separate from the Purview audit log. Microsoft’s sign-in logs page gives the path Entra ID > Monitoring & health > Sign-in logs in the Microsoft Entra admin center, and says viewing them needs at least the Reports Reader role. Microsoft’s Entra data retention page lists:
| Entra ID Free | Entra ID P1 | Entra ID P2 | |
|---|---|---|---|
| Sign-in logs | Seven days | 30 days | 30 days |
| Audit logs (Entra) | Seven days | 30 days | 30 days |
Microsoft also says that with Entra ID Free, collection starts “the first time you open Microsoft Entra ID or use the reporting APIs”. Microsoft describes routing logs to an Azure storage account through Azure Monitor to keep them longer than these defaults.
Which Entra edition a tenant has depends on its plan; the Microsoft 365 licensing and security features reference lists the edition Microsoft gives for each plan.
Microsoft Secure Score: a measure, not a guarantee
Microsoft describes Secure Score as “a measurement of an organization’s security posture, with a higher number indicating more recommended actions taken”. Microsoft’s page says it’s found at security.microsoft.com/securescore in the Microsoft Defender portal. Points are given for configuring recommended features, doing security tasks, or addressing a recommendation with another product or an alternative mitigation. Microsoft says each recommended action is worth 10 points or less.
Microsoft is direct about its limits:
“It isn’t an absolute measurement of how likely your system or data could be breached… No online service is immune from security breaches, and secure score shouldn’t be interpreted as a guarantee against security breach in any manner.”
Microsoft also notes that the recommendations “don’t cover all the attack surfaces associated with each product”. The Microsoft 365 security baseline checklist summarises the settings Microsoft’s wider guidance covers.
Things that change
Microsoft changes audit retention, default alert policies and log retention from time to time. Retention periods on this page are as Microsoft listed them on 21 October 2026.
Common questions
How long are Microsoft 365 audit logs kept?
Microsoft lists 180 days for Audit (Standard), which the Business plans and Microsoft 365 E3 include. With Audit (Premium), which Microsoft lists for E5, records for Microsoft Entra ID, Exchange, OneDrive and SharePoint are kept for one year and other activity for 180 days. Microsoft says 10-year retention needs a separate add-on licence on top of Audit (Premium). Audit (Standard) and Audit (Premium) compares the tiers.
Is auditing turned on by default in Microsoft 365 Business Premium?
Not according to Microsoft. Its “Turn auditing on or off” page says auditing isn’t enabled by default for Business Basic, Business Standard and Business Premium, or for unmanaged tenants on free trials of enterprise licences, and that it has to be turned on manually in those cases. Microsoft also says new organisations should verify the status. Is auditing on by default? quotes Microsoft’s wording.
How do I turn on audit logging in Microsoft 365?
Microsoft’s instructions use the Audit solution in the Microsoft Purview portal. With an account that has the Audit Logs role, open Audit and, if a banner appears, select Start recording user and admin activity. Microsoft says this can take up to 60 minutes to take effect, and events might take several hours after that to become searchable. How to turn auditing on has the steps.
How long are Entra ID sign-in logs kept?
Microsoft’s Entra data retention page lists seven days of sign-in logs with Entra ID Free and 30 days with P1 or P2. Sign-in logs are separate from the Purview audit log, and Microsoft says viewing them needs at least the Reports Reader role. Microsoft describes routing logs to an Azure storage account through Azure Monitor to keep them longer. Microsoft Entra sign-in logs has the path and table.
Can Microsoft 365 alert me when someone creates a forwarding rule?
Microsoft provides a default alert policy called Creation of forwarding/redirect rule. Microsoft notes it only tracks rules created in Outlook on the web or Exchange Online PowerShell, and its table lists which subscriptions each default policy applies to. Alert policies are in the Microsoft Defender portal under Email & collaboration > Policies & rules > Alert policy. Alert policies covers the other examples and the licence notes.
Does a high Secure Score mean my tenant is secure?
No, by Microsoft’s own description. Microsoft says Secure Score “isn’t an absolute measurement of how likely your system or data could be breached” and shouldn’t be read as a guarantee against breach. It measures how many recommended actions have been taken, and Microsoft notes the recommendations don’t cover all attack surfaces. Microsoft Secure Score: a measure, not a guarantee has the full quote.