M365 Auditor

M365 Auditor

Produce a Microsoft 365 audit specification that covers audit log query design, report templates, alert rules, and retention configuration for financial services compliance requirements. The output must be ready for use by a Microsoft Purview administrator and IT security team.

Audit Log Sources and Enablement

Verify and document audit enablement status for each workload:

Audit log retention tier:

For FINRA-regulated broker-dealers: 10-year retention add-on is required for broker communications (FINRA Rule 17a-4). For state-regulated insurance agencies: confirm state-specific retention requirements (typically 5-7 years). Document the license tier and resulting retention period for this client.

Key Audit Event Categories

User Authentication and Identity

Events to capture and review:

Document Access and Sharing

Email Activity

Teams Activity

Admin Configuration Changes

Query Design Templates

Provide ready-to-use Search-UnifiedAuditLog PowerShell query templates.

Weekly security summary query:

# Run every Monday for prior week
$StartDate = (Get-Date).AddDays(-7).ToString("MM/dd/yyyy")
$EndDate = (Get-Date).ToString("MM/dd/yyyy")

# Authentication failures
Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
  -Operations "UserLoginFailed" `
  -ResultSize 1000 |
  Select-Object -ExpandProperty AuditData |
  ConvertFrom-Json |
  Select-Object CreationTime, UserId, Operation, ClientIPAddress, UserAgent |
  Export-Csv ".\weekly-auth-failures.csv" -NoTypeInformation

# External sharing events
Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
  -Operations "SharingInvitationCreated","AnonymousLinkCreated" `
  -ResultSize 1000 |
  Select-Object -ExpandProperty AuditData |
  ConvertFrom-Json |
  Select-Object CreationTime, UserId, Operation, ObjectId, TargetUserOrGroupName |
  Export-Csv ".\weekly-external-sharing.csv" -NoTypeInformation

# Admin role changes
Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
  -Operations "Add member to role.","Remove member from role." `
  -ResultSize 500 |
  Select-Object -ExpandProperty AuditData |
  ConvertFrom-Json |
  Select-Object CreationTime, UserId, Operation, ModifiedProperties |
  Export-Csv ".\weekly-role-changes.csv" -NoTypeInformation

On-demand examination evidence query (for regulatory examiner requests):

# Query specific user activity for examination period
param(
  [string]$UserEmail,
  [string]$StartDate,  # MM/dd/yyyy
  [string]$EndDate     # MM/dd/yyyy
)

$Operations = @(
  "Send","FileAccessed","FileDownloaded","FileDeleted",
  "UserLoggedIn","UserLoginFailed","SharingInvitationCreated"
)

Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate `
  -UserIds $UserEmail `
  -Operations $Operations `
  -ResultSize 5000 |
  Select-Object -ExpandProperty AuditData |
  ConvertFrom-Json |
  Select-Object CreationTime, UserId, Operation, ObjectId, ClientIPAddress, UserAgent |
  Sort-Object CreationTime |
  Export-Csv ".\examination-evidence-$UserEmail.csv" -NoTypeInformation

Report Templates

Weekly Security Summary

Delivered every Monday. Sections:

1. Authentication overview: Total sign-ins, failed sign-ins by user, MFA events, new IP addresses
2. Sharing activity: External shares initiated, anonymous links (should be zero), external guests added to Teams
3. Privilege changes: Admin role grants and removals, policy changes
4. Anomaly highlights: Any event exceeding alert thresholds from the prior week
5. Open items: Alerts from prior week requiring follow-up

Monthly Compliance Report

Delivered first business day of each month. Sections:

1. User activity summary: Active users, inactive users (>30 days no sign-in)
2. Data loss prevention: DLP policy match counts by policy, false positive rate
3. External collaboration: External users with active access, external shares, guest users added/removed
4. Retention compliance: Items subject to retention policies, holds applied
5. Admin activity log: All admin actions during the month
6. Incidents: Any security incidents, escalations, or exceptions granted

Examination Evidence Package

On-demand, per examiner request. Contents:

1. Cover memo: Scope of request, date range, custodians included
2. Email activity export: All sent/received emails for specified users and period (Exchange audit log)
3. Document access log: All file access and sharing events for specified users
4. Communication archive: Teams chat export (requires Microsoft Purview eDiscovery)
5. Chain of custody statement: How data was extracted, who extracted it, what tools were used

Alert Rules

Configure Microsoft Sentinel or Microsoft Defender for Identity (or equivalent SIEM) to alert on:

Audit Log Retention Configuration

Document the retention configuration to be applied:

# Set 10-year audit retention for regulated users (FINRA)
Set-MailboxAuditBypassAssociation -Identity "service@firm.com" -AuditBypassEnabled $false

# Enable mailbox auditing for all users (verify it's on)
Get-Mailbox -ResultSize Unlimited |
  Where-Object {$_.AuditEnabled -eq $false} |
  Set-Mailbox -AuditEnabled $true

# Verify audit log retention tier
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled, AdminAuditLogEnabled

For Microsoft Purview Audit (Premium) 10-year retention: Must be assigned per-user via the Compliance portal > Audit > Audit retention policies. Create a policy with 10-year duration and assign to all licensed users in regulated roles.

Output Format

Deliver as:

1. Audit enablement status table (workload, enabled/not, retention period)
2. Key event catalog organized by category (authentication, document, email, Teams, admin)
3. PowerShell query library (one code block per query template, with usage instructions)
4. Alert rule table with all fields
5. Report templates (one section per report type with exact contents list)
6. Retention configuration steps
7. Regulatory mapping (which specific FINRA rules, state insurance regulations, or internal policies each audit control satisfies)