Audit, Logging & Monitoring · Checklist Sécurité Microsoft 365

Skillplan M365 Checklist

2026-07-20 19:27

Progression de l'évaluation 0 / 136 éléments 0%

Conformité jusqu'à présent 0 / 0 contrôles 0%

Verify the Unified Audit Log is enabled tenant-wide and returns events for searches.

Extend audit log retention to one year for all users via the Audit retention policy (Audit Premium / E5).

Forward Entra ID sign-in and audit logs to Microsoft Sentinel or an external SIEM with at least 90-day hot retention.

Configure SIEM detection rules for high-severity Entra ID, Exchange, and SharePoint events.

Track sign-in log volume monthly; investigate sudden drops as possible log-tampering indicators.

Maintain a runbook for break-glass account sign-in alerts; treat any sign-in as a paging event.

Validate that Defender XDR alerts reach the SOC ticketing system; test injection quarterly.

Route changes to audit and retention policies through change control with security sign-off.