Forum Discussion
Unified Audit Log
Recently took over O365 at a new job. The company is small and the owner knew nothing about IT, so audit logging was not turned on. I just turned it on, but while it is processing, i'm curious if events that occurred prior to enabling audit logging will be viewable. I know mailbox logging is enabled by default and i can see those via powershell.
No, it will not. Some events might still be available in the corresponding workload-specific tools, but the unified audit log will start ingesting only from the date it was enabled.
Thanks. I see some entires for the past few days in the Azure log, but that's about it. There is nothing in the Unified log. This instance has been running for 10 years. VasilMichev
It might take a while for events to start showing (plus different workloads have different SLAs on this), but again, dont expect older stuff to pop up. Even if it did, it will be limited subset, as Microsoft only retains audit logs for 30/90 days depending on the service (generally speaking).
