The Hybrid Enterprise Audit Log Field Guide: On-Prem, M365, Entra, Azure and Beyond

From the Windows Security Log to the M365 so-called Unified Audit Log, the hybrid enterprise is a jungle of exotic log sources – each exotically unique with its own format, cryptic codes, activation policies, and retrieval methods that range from the mundanely cryptic to the outlandish. Consider a few examples:

• Exchange Server’s non-owner mailbox audit records are requested by powershell and then delivered at some highly indefinite point in the future to a mailbox you must monitor in the form of attachments to an indefinite number of emails.
• The Active Directory audit log is fractured across all the domain controller’s security logs and must be collected to a central point before any comprehensive monitoring can be undertaken.
• The Unified Audit Log of M365, which like any log can be massive, can only be accessed in small batches at a time with a complex asynchronous API involving polling, paging and place holders. A query can complete successfully even after exceeding its record-count limit, and there’s an isRecordCountLimitExceeded flag to check. If a script doesn’t check that flag, it silently drops records.

In this real training for free session, I’ll take you on safari through the jungle of audit logs. We’ll locate and observe each log in its native habitat, show you how it’s activated, accessed, what activity it covers and where it has blind spots. We will cover:

• Windows Security log on domain controllers: the authoritative record of domain logons, Kerberos activity, and changes to accounts, groups, GPOs and other directory objects.
• Windows Security log on member servers: local logons, local account and group changes, and file and object access on the servers themselves.
• File servers and NAS: SACL-based object access auditing on Windows file servers, plus the vendor-specific audit trails on NetApp, Isilon and similar devices.
• SharePoint Server audit log: per-site-collection auditing of document views, edits, deletions and permission changes, stored in the content database.
• Exchange Server mailbox audit log: owner, delegate and admin access to mailboxes, plus the admin audit log of every Exchange cmdlet run.
• SQL Server Audit: server- and database-level audit specifications that capture logins, permission changes, schema changes and data access.
• M365 Unified Audit Log (Microsoft Purview Audit): the cloud catch-all for user and admin activity across Exchange Online, SharePoint Online, OneDrive and Teams.
• Exchange Online mailbox auditing: on-by-default mailbox auditing, including MailItemsAccessed, the record you’ll want after a mailbox compromise.
• SharePoint Online and OneDrive: file access, download, sharing and sync events, surfaced through the Unified Audit Log.
• Entra ID audit and sign-in logs: directory changes and every interactive, non-interactive, service principal and managed identity sign-in, with short default retention.
• Azure Activity Log: control-plane operations against Azure resources, such as who created, changed or deleted what, and when.
• Azure Files: data-plane read, write and delete logging, which you only get if you’ve turned on diagnostic settings and sent them somewhere.
• Azure SQL auditing: server- or database-level auditing of logins, queries and permission changes, written to a storage account, Log Analytics or Event Hubs. It only exists once you’ve enabled it and picked a destination.

Whether you’re chasing an intruder, answering an auditor, or proving to a regulator that you know who touched what and when, it all comes down to these logs. They’re often scattered, buried under cryptic event codes, or switched off when you need them most.

My goal for this session is for you to leave knowing exactly which log answers which question, what you need to turn on before an incident (not after), and where the blind spots are that no amount of after-the-fact scripting can fix. That makes this as much about passing your next compliance audit as surviving your next investigation.

Thanks to Netwrix, sponsor of this session. After my part, Netwrix will show how Netwrix Auditor tames this jungle: collecting from every source we cover into one place, translating cryptic events into plain who-what-when-where with before-and-after values, and providing state-in-time reporting on permissions, group membership and configuration.