Jan 18 2021
- last edited on
Apr 01 2022
Recently took over O365 at a new job. The company is small and the owner knew nothing about IT, so audit logging was not turned on. I just turned it on, but while it is processing, i'm curious if events that occurred prior to enabling audit logging will be viewable. I know mailbox logging is enabled by default and i can see those via powershell.
Jan 19 2021 12:06 AM
No, it will not. Some events might still be available in the corresponding workload-specific tools, but the unified audit log will start ingesting only from the date it was enabled.
Jan 19 2021 08:21 AM
It might take a while for events to start showing (plus different workloads have different SLAs on this), but again, dont expect older stuff to pop up. Even if it did, it will be limited subset, as Microsoft only retains audit logs for 30/90 days depending on the service (generally speaking).