Microsoft 365 administration – PowerShell to verify the auditing status for our Organization / Tenant

Hello All,

Greetings.

Today I am sharing small informative article. This article is regarding verifying if an auditing is turned on or not for our organization using PowerShell.

What is Audit Logging?

• Microsoft Purview auditing solutions provide an integrated solution to help organizations effectively respond to
  • security events,
  • forensic investigations,
  • internal investigations,
  • and compliance obligations
• Microsoft Purview Audit provides the ability to log and search for audited activities.
• It enhances forensic, IT, compliance, and legal investigations.
• Audit logging is turned on by default for Microsoft 365 organizations.

In certain scenarios our Organization might not want to retain and record the logs. In this case we need to turn off the auditing.

Details

• We will use the Get-AdminAuditLogConfig PowerShell CMDLET
• Get-AdminAuditLogConfig PowerShell CMDLET is available in Exchange Online PowerShell module
• Make sure, “Exchange Online PowerShell” module is installed. If it is not installed then install the module using “Install-Module” PowerShell CMDLET as

Install-Module -Name ExchangeOnlineManagement -Force

• Once we have successfully installed PowerShell module “ExchangeOnlineManagement“, we are ready to execute the Exchange Online PowerShell CMDLETs
• We will connect to Exchange Online using “Connect-ExchangeOnline” PowerShell CMDLET

Connect-ExchangeOnline

• As we successfully manage to connect ExchangeOnline, we are ready to execute Exchange Online PowerShell CMDLETs
• To verify auditing status of our organization, we will execute “Get-AdminAuditLogConfig” PowerShell CMDLET as

PS C:\Windows\System32> Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

UnifiedAuditLogIngestionEnabled : True

PS C:\Windows\System32>

• A value of True for the UnifiedAuditLogIngestionEnabled property indicates that auditing is turned on in our tenant.

REFERENCES

• PowerShell Modules / CMDLETs – Connecting to Microsoft 365 Services – https://knowledge-junction.in/2025/06/09/powershell-connecting-to-microsoft-365-services/
• PowerShell – Exploring Module CMDLETs – https://knowledge-junction.in/2022/12/12/__trashed-2/

Thanks for reading!!!

HAVE A FANTASTIC TIME AHEAD !!! LIFE IS BEAUTIFUL 🙂