Audit, Logging & Monitoring · Microsoft 365 Security Checkliste

Skillplan M365 Checklist

2026-07-20 00:25

Bewertungsfortschritt 0 / 136 Elemente 0%

Bisherige Erfüllung 0 / 0 Kontrollen 0%

Verify the Unified Audit Log is enabled tenant-wide and returns events for searches.

Extend audit log retention to one year for all users via the Audit retention policy (Audit Premium / E5).

Forward Entra ID sign-in and audit logs to Microsoft Sentinel or an external SIEM with at least 90-day hot retention.

Configure SIEM detection rules for high-severity Entra ID, Exchange, and SharePoint events.

Track sign-in log volume monthly; investigate sudden drops as possible log-tampering indicators.

Maintain a runbook for break-glass account sign-in alerts; treat any sign-in as a paging event.

Validate that Defender XDR alerts reach the SOC ticketing system; test injection quarterly.

Route changes to audit and retention policies through change control with security sign-off.