Audit, Logging & Monitoring · Checklist Sicurezza Microsoft 365

Skillplan M365 Checklist

2026-07-20 19:26

Avanzamento valutazione 0 / 136 elementi 0%

Conformità finora 0 / 0 controlli 0%

Verify the Unified Audit Log is enabled tenant-wide and returns events for searches.

Extend audit log retention to one year for all users via the Audit retention policy (Audit Premium / E5).

Forward Entra ID sign-in and audit logs to Microsoft Sentinel or an external SIEM with at least 90-day hot retention.

Configure SIEM detection rules for high-severity Entra ID, Exchange, and SharePoint events.

Track sign-in log volume monthly; investigate sudden drops as possible log-tampering indicators.

Maintain a runbook for break-glass account sign-in alerts; treat any sign-in as a paging event.

Validate that Defender XDR alerts reach the SOC ticketing system; test injection quarterly.

Route changes to audit and retention policies through change control with security sign-off.