Power faster and more effective forensic and compliance investigations

The following is provided from Microsoft Security and Compliance blogs at TechCommunity:

We are pleased to share that Advanced Audit for Microsoft 365 is now rolling out. The new set of capabilities are aimed to power faster and more effective forensic compliance investigations.

These updates include:

Extending the preservation of a user’s audit activities from 90 days to 1 year
Increasing bandwidth access to the Management Activity API
Access to crucial events for investigations

Longer-term retention

Currently, audit logs are retained for 90 days by default. With Advanced Audit you are now able to retain audit logs for more than 90 days and up to 1 year for eligible users.

To apply the custom retention policy, within the audit log search, you can create a new retention policy and choose the appropriate duration within the UI or through cmdlets. You can also add more policies or customize existing ones. More details are available here.

[Image: Add a new retention policy for an individual user’s audit log activities for up to 1 year]

Faster access to data

In the past, customers consuming logs through the Office 365 Management Activity API were limited by throttling limits at the publisher level, which means that for a publisher pulling data on behalf of multiple customers, the limit was shared by all those customers.

With this release, we are moving from publisher-based to tenant-based limits so each tenant will get their fully allocated bandwidth quota to access their auditing data. The bandwidth will be determined by a combination of factors including the number of seats in the tenant and their license subscription.

All tenants will start with a baseline of 2,000 requests per minute and will go up depending on their seat count, and E5 customers with Advanced Audit will get more bandwidth than non-E5 customers to provide faster access to data. Note that there will also be an upper cap for bandwidth to protect the health of the service. You can learn more from our documentation here.

Access crucial events for investigations

With Advanced Audit, one of the first events we are releasing is MailItemsAccessed. With this new event, access of data over mail protocols/clients will be audited to help investigators better understand scope of compromise.

The new MailItemsAccessed action is exposed as a part of Exchange Mailbox Auditing and is enabled by default. You can learn more from our documentation here.

[Image: users can now see audit activity such as the MailItemsAccessed event]

Get Started

For Microsoft 365 E5 customers, Advanced Audit is rolling out over the next few weeks. You can also sign up for a trial or navigate to the Microsoft 365 compliance center to get started today.

Learn more about what’s new with Advanced Audit and how to configure policies in your tenant in this supporting documentation. We look forward to hearing your feedback.