How to Export and Review the Microsoft 365 Unified Audit Log
Summary
A practical guide to exporting Microsoft 365 Unified Audit Log events with Exchange Online PowerShell and reviewing them for BEC indicators. It covers access, retention, search limits, relevant operations and troubleshooting.
Key points
- Purview Audit search can export results to CSV, while Exchange Online PowerShell's Search-UnifiedAuditLog can export each event's AuditData as a JSON line.
- A session loop can retrieve up to 50,000 records per search; split the time window into smaller searches to work around that limit.
- Check that Unified Audit Log ingestion is enabled. Turning it on does not backfill events that were not recorded.
- Audit searches require the Audit Logs or View-Only Audit Logs role; events may take an hour or two, and timestamps are stored in UTC.
- The guide highlights inbox-rule changes, external mailbox forwarding, mailbox permissions, MailItemsAccessed, bulk file downloads and application consent as investigation leads.
- Standard audit retention is 180 days; Audit (Premium) retains a year by default. Entra sign-in logs provide richer MFA, Conditional Access and risk details.
Article Details
- Defense Focus
- Export and review Microsoft 365 Unified Audit Log data to investigate mailbox compromise, unauthorized mailbox access, and bulk file downloads.
- Detection Methods
- Review New-InboxRule, Set-InboxRule, and UpdateInboxRules events for rules that forward, move, or delete mail; inspect AuditData parameters.
- Check Set-Mailbox events for ForwardingSmtpAddress values that forward mail externally.
- Review Add-MailboxPermission and Add-RecipientPermission events for newly granted mailbox access.
- Use MailItemsAccessed events to identify messages read during a suspected breach.
- Look for bursts of FileDownloaded and FileSyncDownloadedFull events involving SharePoint or OneDrive.
- Review application consent events for unauthorized access to mail or files.
- Correlate a sign-in from a new location with an inbox rule created shortly afterward.
- Data Sources
- Unified Audit Log events, including AuditData JSON
- Entra sign-in logs, including authentication, MFA, Conditional Access, and risk details
- Rule Types
- PowerShell commands and script
- JSONL audit-event output
- CSV audit-log export
- Defensive Actions
- Verify Unified Audit Log ingestion is enabled; enabling it later does not backfill earlier activity.
- Use an account with the Audit Logs or View-Only Audit Logs role.
- Export both Unified Audit Log data and Entra sign-in logs when investigating authentication and mailbox activity.
- Account for ingestion delays and UTC timestamps when choosing the search window.
- Use a session with ReturnLargeSet to page beyond 5,000 records, up to 50,000 per search; split the time window if the session limit is reached.
- Check the tenant's audit retention period when investigating older activity.
- Sanitize exported data before reviewing it in LogTotal.
MITRE ATT&CK
T1098.002 · Additional Email Delegate PermissionsThe article identifies extra mailbox permissions as a behavior to detect in audit events.T1114.003 · Email Forwarding RuleThe article identifies inbox forwarding rules that siphon mail as a detection use case.T1213.002 · SharepointThe article identifies data pulled from SharePoint as a behavior covered by its detection rules.
Vendors
Products
EntraIsn’t this the same as Entra sign-in logs?Exchange OnlineTo get clean JSON, one event per line, use Exchange Online PowerShell and Search-UnifiedAuditLog.Microsoft 365 Apps for EnterprisePrime Core has 79 detection rules for Microsoft 365 audit data, mapped to 33 MITRE ATT&CK techniques.Microsoft OneDriveThe Unified Audit Log covers Exchange, SharePoint, OneDrive, Teams and admin activity in one place.Microsoft PurviewThe Purview portal (Audit → Search) lets you search the Unified Audit Log and export the results to CSV.Microsoft SharePointThe Unified Audit Log covers Exchange, SharePoint, OneDrive, Teams and admin activity in one place.TeamsThe Unified Audit Log covers Exchange, SharePoint, OneDrive, Teams and admin activity in one place.