The short answer: one log, two tiers, three ways to search
Microsoft describes the unified audit log as the place where an organization captures, records and retains thousands of user and admin operations performed in dozens of Microsoft services, so that security operations, IT administrators, insider risk teams and legal investigators can search one store instead of many (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20). How long a record survives depends on two things: the license of the user who performed the activity, and any audit log retention policy that matches it. How you get records out depends on the job: the Audit solution in the Microsoft Purview portal for an investigator, the Search-UnifiedAuditLog cmdlet for an administrator with a script, and Microsoft Graph or the Office 365 Management Activity API for a security platform. EPC Group's Microsoft 365 consulting practice sets all three up before an incident, because the most common audit failure is not a missing event but a record that aged out before anyone looked for it.
What the audit log records
The Search-UnifiedAuditLog reference lists the core sources: events from Exchange Online, SharePoint, OneDrive, Microsoft Entra ID, Microsoft Teams, Power BI and other Microsoft 365 services, filterable by user, action or target object (Microsoft Learn, Search-UnifiedAuditLog, accessed 2026-10-20). In SharePoint and OneDrive, the record types an investigator uses most are SharePointFileOperation, which carries activities such as FileAccessed, and SharePointSharingOperation, which carries sharing and access-request activity (Microsoft Learn, Export, configure, and view audit log records, accessed 2026-10-20).
Exchange is audited at two levels. Administrator actions appear in the unified log, and mailbox audit logging is on by default for user mailboxes, shared mailboxes and Microsoft 365 Group mailboxes, logging a predefined set of actions for each sign-in type: Admin, Delegate and Owner. The default set includes MailItemsAccessed, SendAs, SendOnBehalf, SoftDelete, HardDelete, UpdateFolderPermissions and UpdateInboxRules. Public folder and resource mailboxes are not supported, and the Set-MailboxAuditBypassAssociation cmdlet can stop all mailbox logging for a named account, which is why EPC Group checks for bypass associations in every tenant review (Microsoft Learn, Manage mailbox auditing, accessed 2026-10-20). For Entra, the log contains user, group, application, domain and directory activities performed in the Microsoft 365 admin center or the Azure portal, and Power BI activities appear only after auditing is enabled in the Power BI admin portal (Microsoft Learn, Search the audit log, accessed 2026-10-20).
Some events exist only for licensed users. Audit (Premium) provides the SensitivityLabel property on MailItemsAccessed and the AppAccessContext property on Teams chat and message events such as MessageSent, MessageRead and ChatRetrieved, and Microsoft states that users must be assigned the appropriate Audit (Premium) license for those records to be generated at all (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20). Timing matters too: for core services, records typically become searchable 60 to 90 minutes after the event, and Microsoft does not commit to a specific time (Microsoft Learn, Search the audit log, accessed 2026-10-20).
How long records are kept, by license
Audit (Standard) retains records for 180 days, which means searches can reach activity from the past six months (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20). Audit (Premium) adds a default audit log retention policy that keeps every record whose Workload property is AzureActiveDirectory, Exchange, OneDrive or SharePoint for one year. That default policy cannot be modified, does not appear in the dashboard or in Get-UnifiedAuditLogRetentionPolicy output, and applies only to activity by users assigned an Office 365 E5 or Microsoft 365 E5 license, a Microsoft Purview Suite license, or an E5 eDiscovery and Audit add-on. Non-E5 users and guests stay at 180 days (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20).
The practical consequence is that a mixed-license tenant has mixed evidence. If an investigation concerns a frontline worker on a non-E5 plan, the trail ends at 180 days no matter what the security team's own licenses are. EPC Group writes this into the retention decision explicitly, listing which populations hold records for 180 days, which for one year and which for longer, so that a compliance officer is not surprised during an audit.
Extending retention with audit log retention policies
Audit log retention policies are an Audit (Premium) capability. They are created in the Purview portal by a user with the Organization Configuration role, from the Audit solution's Create audit retention policy option, and each one names users (or all users), one or more record types, optional activities, a duration and a priority. The available durations are 7 days, 30 days, 6 months, 9 months, 1 year, 3 years, 5 years and 7 years, plus 10 years for users with the 10-Year Audit Log Retention add-on. Licensing decides which of them actually holds: keeping a record longer than 180 days (up to 1 year) requires the user who generated it to hold an Office 365 or Microsoft 365 E5 license or a Microsoft Purview Suite or E5 eDiscovery and Audit add-on; Microsoft lists the 3-, 5- and 7-year options, like 10 years, as needing the 10-Year Audit Log Retention add-on in addition to E5; and when the generating user lacks the license for the chosen duration, the record follows the highest-priority policy that user's license supports (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-28). Priority runs from 1 (highest) to 10000 (lowest), every custom policy outranks the default policy, and an organization can hold up to 50 policies (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20).
Two behaviors catch administrators out. First, a custom policy that is shorter than one year shortens retention of Exchange, SharePoint or Entra records below the default, because custom policies always win. Second, a record's lifetime is set when it enters the auditing pipeline, so a new policy or a license change does not rescue records already written (same source). Microsoft adds that 10-year policies are not retroactive and that records generated by non-user entities such as service principals are kept for a fixed one year that custom policies cannot change (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20). Policies can also be managed in Security & Compliance PowerShell with New-UnifiedAuditLogRetentionPolicy, Set-UnifiedAuditLogRetentionPolicy and Remove-UnifiedAuditLogRetentionPolicy, which is the only way to edit a policy built on a record type the portal does not list (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20). EPC Group's data governance practice keeps these policies in the same register as the organization's Purview retention labels, so content retention and evidence retention are reviewed together.
How to search and export
Searching requires the View-Only Audit Logs or Audit Logs role. By default the Audit Reader role group can search and export, and the Audit Manager role group can also change audit settings such as turning logging on or off (Microsoft Learn, Get started with auditing solutions, accessed 2026-10-20). In the Purview portal, the Audit solution runs search jobs filtered by date range, users, activities and record types; the job dashboard shows date in UTC, IP address, user, record type, activity, item and admin unit, and Export produces a CSV of up to 50,000 rows for Audit (Standard) or 1,000,000 rows for Audit (Premium) (Microsoft Learn, Search the audit log, accessed 2026-10-20). The CSV holds an AuditData column of JSON that Power Query in Excel can split into one column per property; Microsoft recommends narrowing the date range or running segmented searches when results exceed the export limit (Microsoft Learn, Export, configure, and view audit log records, accessed 2026-10-20).
In Exchange Online PowerShell, Search-UnifiedAuditLog takes StartDate and EndDate plus filters such as RecordType, Operations, UserIds, ObjectIds, IPAddresses and FreeText. It returns 100 records by default; running it repeatedly with the same SessionId and SessionCommand ReturnLargeSet pages through up to 50,000 unsorted results, and mixing session commands on one SessionId limits output to 10,000 (Microsoft Learn, Search-UnifiedAuditLog, accessed 2026-10-20). For programmatic collection, Microsoft recommends the Office 365 Management Activity API over scripted cmdlet calls, and Microsoft Graph offers the auditLogQuery resource, whose permissions are scoped by service, from AuditLogsQuery-Entra.Read.All through AuditLogsQuery-SharePoint.Read.All to AuditLogsQuery.Read.All (Microsoft Learn, Create auditLogQuery, accessed 2026-10-20). EPC Group grants the narrowest of these to any SIEM connector or investigation app.
Test retrieval before you rely on it
Retention settings say what should be kept; only a search shows what can be found. Microsoft does not guarantee when a record appears: for Exchange, SharePoint, OneDrive and Teams it is typically 60 to 90 minutes after the event, and longer for other services (Microsoft Learn, Search the audit log, accessed 2026-10-31). Before an audit or an investigation depends on the log, EPC Group generates known test events (a file opened by an E5 user and by a non-E5 user, a mail sent, a team created, a Copilot prompt, a Power BI report view), searches for each after the wait, checks that a restricted admin sees only its scope, exports the result, and confirms that a record past its retention period is gone. The audit log retrieval validation record (CSV) lists those tests with the expected result and pass rule; its rows are examples, not client data.
Documented work
ANON-CASES: EPC Group engagement data for Microsoft Purview Audit covers mid-size and large healthcare and financial-services organizations that needed a written audit retention decision, scoped search roles and repeatable evidence exports ahead of regulatory and customer audits, delivered by the firm's Microsoft 365 consulting practice. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Learn about auditing solutions in Microsoft Purview — Microsoft Learn, accessed 2026-10-20
- Manage audit log retention policies — Microsoft Learn, accessed 2026-10-20
- Search the audit log — Microsoft Learn, accessed 2026-10-20
- Search-UnifiedAuditLog — Microsoft Learn, accessed 2026-10-20
- Manage mailbox auditing — Microsoft Learn, accessed 2026-10-20
- Export, configure, and view audit log records — Microsoft Learn, accessed 2026-10-20
- Get started with auditing solutions — Microsoft Learn, accessed 2026-10-20
- Create auditLogQuery — Microsoft Learn, accessed 2026-10-20
- Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What is the difference between Audit (Standard) and Audit (Premium)?
Both are on by default and both provide the Purview audit search tool, the Audit Search Graph API, the Search-UnifiedAuditLog cmdlet, CSV export and the Office 365 Management Activity API, with 180-day retention. Audit (Premium) adds retention of up to one year by default for Entra, Exchange, OneDrive and SharePoint records, custom audit log retention policies, 10-year retention for users with the add-on license, intelligent insights such as MailItemsAccessed with the SensitivityLabel property, and higher bandwidth to the Management Activity API (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20).
How long are audit records kept and can retention be extended?
Users without an E5-level license have their records retained for 180 days. For users with an Office 365 E5 or Microsoft 365 E5 license, or a Microsoft Purview Suite or E5 eDiscovery and Audit add-on, a default policy that cannot be modified keeps Exchange, SharePoint, OneDrive and Entra records for one year. Custom audit log retention policies, up to 50 per organization, can extend other records, and the 3-, 5-, 7- and 10-year options need the 10-Year Audit Log Retention add-on on top of E5, assigned to the user who generates the record (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-28). Policies are not retroactive.
Which events are recorded for SharePoint, Exchange, Teams and Entra?
The log captures thousands of user and admin operations across dozens of services (Microsoft Learn, Learn about auditing solutions in Microsoft Purview, accessed 2026-10-20). SharePoint and OneDrive record file operations such as FileAccessed and sharing operations; Exchange mailbox auditing is on by default and logs owner, delegate and admin actions such as MailItemsAccessed, SendAs, HardDelete and UpdateInboxRules (Microsoft Learn, Manage mailbox auditing, accessed 2026-10-20). Entra records user, group, application, domain and directory activities, and Power BI activities need auditing enabled in the Power BI admin portal (Microsoft Learn, Search the audit log, accessed 2026-10-20).
How do you search and export the log with the portal, PowerShell and Graph?
In the Microsoft Purview portal, the Audit solution runs search jobs filtered by date, user, activity and record type, and exports up to 50,000 rows under Audit (Standard) or 1,000,000 under Audit (Premium) (Microsoft Learn, Search the audit log, accessed 2026-10-20). In Exchange Online PowerShell, Search-UnifiedAuditLog returns 100 records by default; SessionCommand ReturnLargeSet pages through up to 50,000 (Microsoft Learn, Search-UnifiedAuditLog, accessed 2026-10-20). Microsoft Graph exposes the same search through the auditLogQuery resource with AuditLogsQuery permissions (Microsoft Learn, Create auditLogQuery, accessed 2026-10-20).
How is the audit log used in a HIPAA or SOC 2 audit?
Microsoft signs a HIPAA Business Associate Agreement and states that using its services does not on its own achieve HIPAA compliance; the customer remains responsible for its own program and processes (Microsoft Learn, Health Insurance Portability and Accountability Act (HIPAA) & Health Information Technology for Economic and Clinical Health (HITECH) Act, accessed 2026-10-20). EPC Group therefore treats the audit log as customer-side evidence: a written retention decision per workload, saved searches for access to regulated mailboxes and sites, a named Audit Reader for each investigator, and exported search results filed with the control they support.
Talk to a senior architect
If your organization has not written down how long its audit evidence lives, or who is allowed to search it, a 30-minute discovery call with a senior EPC Group architect will map your licenses to retention and set out the policies and roles to add. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.