Audit Readiness

Microsoft 365 and Azure Government produce audit logs at every layer of the stack: identity, applications, data, devices, and infrastructure. This chapter maps those sources, explains how to operate them, and defines what a complete evidence package looks like for CMMC Level 2 (GCC High) and SOC 2 Type II (Commercial) assessments.

---

Log Source Reference

Microsoft 365 Unified Audit Log (UAL)

The UAL records supported activities across Exchange, SharePoint, Teams, OneDrive, Purview, and Entra. It is not an email message-trace service or a substitute for the full Entra sign-in logs. Match the evidence requirement to the documented activity and source.

Access: Purview compliance portal → Audit → New search (or Search → Audit log search in legacy portal)

Key parameters:

Parameter	Notes
Date range	Maximum 180 days per search; stagger searches for longer periods
Activities	Filter by specific operation types (e.g., FileAccessed, SensitivityLabelApplied)
Users	Filter to specific UPNs for user-specific investigation
File/folder	Filter to specific SharePoint/OneDrive paths
Record type	Filter by workload (ExchangeItem, SharePointFileOperation, etc.)

Retention:

• Purview Audit Standard: 180 days for records generated on or after October 17, 2023.
• Purview Audit Premium: 1 year by default for covered Exchange, SharePoint, OneDrive, and Entra activities generated by appropriately licensed users; other activities default to 180 days unless a retention policy changes this. Ten-year retention requires the separate 10-Year Audit Log Retention add-on and a configured policy. See audit retention policies.

PowerShell export:

# GCC High; Commercial uses Connect-IPPSSession without these endpoints.
Connect-IPPSSession -ConnectionUri https://ps.compliance.protection.office365.us/powershell-liveid/ -AzureADAuthorizationEndpointUri https://login.microsoftonline.us/organizations

$endUtc = (Get-Date).ToUniversalTime()
$startUtc = $endUtc.AddDays(-90)
$sessionId = [guid]::NewGuid().ToString()
$results = [System.Collections.Generic.List[object]]::new()
do {
    $batch = @(Search-UnifiedAuditLog -StartDate $startUtc -EndDate $endUtc -RecordType SharePointFileOperation -SessionId $sessionId -SessionCommand ReturnLargeSet -ResultSize 5000 -ErrorAction Stop)
    foreach ($record in $batch) { $results.Add($record) }
    if ($results.Count -ge 50000) {
        throw "Search reached its 50,000-record cap. Split the time range and rerun before claiming a complete export."
    }
} while ($batch.Count -gt 0)
$results | Sort-Object Identity -Unique | Export-Csv -Path ".\UAL_SharePoint_90days.csv" -NoTypeInformation
Disconnect-ExchangeOnline -Confirm:$false

The GCC High connection parameters differ from Commercial. Search-UnifiedAuditLog returns pages, with a 50,000-record session ceiling; a single 5,000-row call is not a complete 90-day export. For sustained collection use the supported audit export/API pipeline and reconcile coverage.

Purview Audit: High-Value Events

Do not use these event names as proof that a user has Audit Premium. Microsoft's expanded Standard logging includes these investigation activities; verify the workload, mailbox auditing configuration, and events actually generated in your tenant.

Event	Value
MailItemsAccessed	Mailbox access evidence using bind/sync semantics and aggregation; not a one-to-one record of a human reading each message
Send	Records every sent message (vs. just delivery)
SearchQueryInitiatedExchange	Records mailbox search queries: detects internal reconnaissance
SearchQueryInitiatedSharePoint	Records SharePoint search queries

Audit Premium is per user, not per tenant: the user who performs the activity must hold an E5 (or the E5 eDiscovery and Audit add-on) with the Microsoft 365 Advanced Auditing service plan turned on (Microsoft 365 admin center > Users > Active users > the user > Licenses and apps > Apps > Microsoft 365 Advanced Auditing; insights begin within 24 hours). A retention policy applies only to records from users licensed for its duration; creating a one-year policy for all users does not license anyone, and non-E5 and guest users' records stay at 180 days. The default one-year policy for the four core workloads needs no configuration; create custom policies for other record types (Teams, Purview label events) and for ten-year retention. See MailItemsAccessed and expanded Standard logging.

Entra ID Audit and Sign-In Logs

Sign-in logs: Every authentication event: user sign-ins, service principal sign-ins, managed identity sign-ins. Each entry includes user, application, IP address, location, device, Conditional Access policies applied, and result (success, failure, interrupted).

Audit logs: All directory changes: user creation/deletion, group membership changes, role assignments, application consent grants, PIM activations, password resets.

Access: Entra admin center → Monitoring → Sign-in logs / Audit logs (or portal.azure.us for GCC High)

Retention in Entra: 30 days (P1/P2 license); 7 days without Entra ID P1. For longer retention, export to Log Analytics (via Sentinel) or Azure Storage.

PowerShell export:

# Entra audit logs via Graph API
Connect-MgGraph -Scopes "AuditLog.Read.All" -Environment USGov  # USGov for GCC High

$sinceUtc = (Get-Date).ToUniversalTime().AddDays(-30).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $sinceUtc" -All |
    Select-Object ActivityDateTime, ActivityDisplayName, Result,
        @{Name='InitiatedBy'; Expression={$_.InitiatedBy | ConvertTo-Json -Depth 10 -Compress}},
        @{Name='TargetResources'; Expression={$_.TargetResources | ConvertTo-Json -Depth 10 -Compress}} |
    Export-Csv -Path ".\EntraAuditLog.csv" -NoTypeInformation

Azure Activity Log

The Azure Activity Log records all control-plane operations on Azure resources: VM creation/deletion, storage account configuration changes, Key Vault access policy changes, RBAC role assignments, network security group modifications.

Access: Azure portal → Monitor → Activity log (portal.azure.us for GCC High)

Retention: 90 days in the Azure portal. Route to Log Analytics (Sentinel) for longer retention: required for compliance.

Critical events to monitor:

Operation	Risk
Microsoft.Authorization/roleAssignments/write	New RBAC role assignment: potential privilege escalation
Microsoft.KeyVault/vaults/write	Key Vault resource configuration change
Microsoft.Network/networkSecurityGroups/write	NSG rule changes: potential firewall bypass
Microsoft.Compute/virtualMachines/delete	VM deletion: potential evidence destruction
Microsoft.Storage/storageAccounts/write	Storage account config change

Key Vault secret reads and writes are data-plane events. Enable the vault's AuditEvent diagnostic category and collect resource logs (for example AZKVAuditLogs); Azure Activity alone is not evidence of secret access (Key Vault logging).

Intune Audit Log

Records all administrative actions in Intune: policy creation/modification/deletion, device wipes, compliance policy changes. See Intune Diagnostics & Audit Evidence for details and export procedures.

Defender for Endpoint Audit Trail

MDE records: device onboarding/offboarding events, investigation actions (device isolation, file quarantine, live response commands), alert state changes, and exclusion modifications.

Access: Search Microsoft Purview > Audit for supported Defender administrative activities; use Defender's Action center > History for remediation actions. Settings > Endpoints > General > Advanced features (labeled Optional features in the GCC High portal) configures features and is not the audit-log viewer; the audit record of a change made there is the Purview SetAdvancedFeatures activity. Check the documented Defender audit activities for the action being evidenced.

Purview DLP and Label Activity

• DLP policy matches: Purview → Data loss prevention → Alerts (real-time); Reports → DLP policy matches (historical)
• Label events: Purview → Data classification → Activity Explorer: all label apply/change/remove events with justification text for downgrades

---

Operational Audit Procedures

Configuring Audit Log Retention Policies

In Purview Audit, create a retention policy before logs start rolling off:

1. Purview compliance portal → Audit → Audit retention policies → New policy
2. Policy name: "Default 1-Year Retention"
3. Record types: All (or specify Exchange, SharePoint, AzureActiveDirectory, etc.)
4. Duration: 1 year (requires Audit Premium / E5)
5. Priority: 1 (lowest number = highest priority)

For ten-year retention, obtain the 10-Year Audit Log Retention add-on for the relevant users and configure a policy for the required record types. E5 or the ordinary Purview compliance add-on alone is not the ten-year entitlement.

Routing Logs to Sentinel / Log Analytics

Route all log sources to Sentinel for long-term retention and cross-source correlation. See SIEM Strategy for connector configuration. Once in Log Analytics, logs are queryable indefinitely (up to the workspace retention setting).

Alert on Audit Log Gaps

Configure an alert if audit logging is disabled or interrupted:

// Example: run hourly with a 24-hour lookback; tune for expected traffic.
OfficeActivity
| where TimeGenerated > ago(24h)
| summarize LastEvent = max(TimeGenerated), EventCount = count()
| where EventCount == 0 or LastEvent < ago(4h)
| project LastEvent, Alert="Unified Audit Log ingestion gap detected"

Test both stale-data and completely empty-window cases. max() is null on an empty input, so checking only LastEvent < ago(4h) silently misses a total outage. A quiet source can also produce this result; tune the threshold and monitor connector health separately. If the table does not exist or the rule fails to execute, the query cannot alert on itself.

---

Assessor Evidence Packages

GCC High (CMMC)

CMMC Level 2 Evidence Package

A CMMC Level 2 assessment (C3PAO or government-led) requires evidence that each practice is implemented. The following log-based artifacts satisfy the audit domain (AU) practices and support other practice families.

AU Domain: Audit and Accountability

NIST Control	Evidence Required	Source
3.3.1: Audit records	Demonstrate audit logging is enabled across all in-scope systems	UAL configuration screenshot; Entra diagnostic settings showing log routing to Log Analytics; Azure Activity Log routing configuration
3.3.2: User accountability	Demonstrate actions are uniquely traceable to individual users	Entra ID sign-in logs (per-user attribution); Purview Unified Audit Log (UserId on each record); Sentinel DeviceLogonEvents
3.3.3: Review and update logged events	Demonstrate the set of audited events is periodically reviewed and updated	OIB Audit and Event Logging policy config (audited subcategories); documented periodic review of the audit-event scope in the SSP
3.3.4: Audit failure alert	Demonstrate alerts fire if logging fails	Sentinel rule alerting on audit gap (KQL rule export); Azure Monitor alert for Entra diagnostic failure
3.3.5: Audit analysis	Demonstrate correlation/analysis capability	Sentinel analytics rules (exported list with KQL); workbook screenshots
3.3.6: Reduction and reporting	Demonstrate summary reporting	Sentinel workbook exports (monthly); Compliance Manager score history
3.3.7: Authoritative time source	Demonstrate clocks are synchronized with an authoritative source	Endpoint/server time-source configuration and synchronization evidence, plus service time-stamp documentation; a UTC display alone does not prove clock synchronization
3.3.8: Protect audit logs	Demonstrate protection from unauthorized access, modification, and deletion	Effective workspace/resource/table access and privileged-role review; protection of exports, including immutability where required
3.3.9: Limit audit management	Demonstrate only authorized personnel manage audit	Entra PIM audit: who has Log Analytics Contributor and Security Administrator roles

Assembling the Evidence Package

Prepare the following artifacts for each AU control:

1. UAL configuration: Screenshot of Purview Audit showing audit is enabled, retention policy settings, and the audit retention policy covering all record types
2. Log routing: Screenshot of Entra diagnostic settings and Azure Monitor settings showing export to Log Analytics workspace name
3. Analytics rules: Export from Sentinel: list of enabled analytics rules with name, severity, and data source
4. 90-day audit log export: CSV export from UAL (at minimum Exchange + SharePoint + Entra operations) covering the assessment period
5. Sentinel incident log: Export of Sentinel incidents for the past 90 days showing triage and closure
6. Access control for audit logs: PIM role assignment report showing who has Log Analytics access and when they last activated it

Commercial

SOC 2 Type II Evidence Package

SOC 2 Type II evaluates operating effectiveness over a defined reporting period, rather than at one point in time. Agree that period with the auditor; it is not universally 12 months. The examples below assume a 12-month period and should be adjusted to the engagement.

Relevant Trust Service Criteria

TSC	Criteria	Evidence
CC7.2	Monitor for anomalies	Sentinel analytics rules list; sample alert evidence from period
CC7.3	Evaluate security events	Sentinel incident log (12 months); evidence of investigation and closure for significant incidents
CC7.4	Respond to anomalies	Playbook exports; incident response documentation showing playbook execution
CC6.1	Logical and physical access	Entra sign-in logs showing Conditional Access enforced; Intune compliance report
CC6.2	New access provisioning	Entra audit log: user creation + access package assignment events for the audit period
CC6.3	Access removal	Entra audit log: user disable/delete events correlated with HR offboarding
CC6.6	Network protection	Azure Firewall logs; virtual network flow logs and traffic analytics
A1.2	Monitoring for availability	Azure Monitor availability alerts; Log Analytics uptime data

Assembling the SOC 2 Evidence Package

1. Sentinel analytics rules: List of rules enabled throughout the audit period (take a snapshot at period start and end; show no gaps)
2. Sentinel incident log: 12-month export showing all incidents created, severity, and closure status with disposition
3. Entra sign-in summary: Monthly aggregate: total sign-ins, blocked by CA, MFA challenges, risky sign-ins (Entra Identity Protection report)
4. Access provisioning/deprovisioning log: Entra audit log filtered to user creation, group add, user disable, license removal operations for the audit period
5. UAL export: Targeted exports for any significant security events referenced in the incident log
6. Azure Activity log: RBAC changes, Key Vault access, network configuration changes for the audit period

SOC 2 auditors typically request evidence in the form of exports (CSV or Excel) for sampling. Prepare the 12-month Entra audit export and 12-month Sentinel incident list as the baseline; pull UAL exports for specific incidents the auditor flags for deeper review.

Organizing Evidence for the Assessment

The evidence ingredients (logs, policies, configurations, screenshots) only matter if an assessor can find and trust the specific artifact they ask for in the moment. A defensible evidence package needs a single source of truth: one system that maps each CMMC practice to the evidence satisfying it, the owner who produced it, and the date it was last refreshed.

Three platforms dominate this space in the DIB market, each with a different sweet spot:

• FutureFeed: the closest analog to QuickBooks for CMMC. Strong at catalog-style evidence organization, practice-to-artifact mapping, and self-assessment workflows. Best fit when the assessment is the primary driver and the organization wants an opinionated structure.
• IntelliGRC: automation-forward, with particular strength in the Shared Responsibility Matrix (SRM) model for MSPs managing compliance across multiple client tenants. Best fit for service providers who need to reuse a single evidence pattern across a book of business.
• StrikeGraph: AI-native, integrates tightly with modern SaaS stacks, and offers a 60-day free trial path into a Level 2 self-assessment. Best fit when the organization is still deciding whether to engage a C3PAO and wants a low-commitment on-ramp.

Picking the wrong tool is a recoverable mistake; not picking one (and defaulting to SharePoint folders and ad-hoc spreadsheets) is the failure mode that burns C3PAO time during an assessment and costs you a remediation cycle.

Attribution

This comparison draws on roundtables and sessions at CS5 2026 with Stuart Itkin (FutureFeed), Phillip Donald (IntelliGRC), and Justin Beals (Strike Graph).

Working with Your C3PAO

A C3PAO is explicitly prohibited from consulting with, coaching, or implementing solutions for a client they are actively assessing. The relationship therefore starts further from you than your implementation partner's, and stays there.

Selection

Use selection conversations to stress-test boundary questions you know you'll care about, not generic compliance credentials:

• "Do Teams meetings initiated from a secure enclave retain the enclave boundary, or do they extend scope to peer tenants?"
• "Is an AVD KVM session a CUI-handling control or a CUI-processing control?"
• "What evidence format do you prefer: catalog (FutureFeed-style), document-driven, or SRM-driven?"

A C3PAO who answers these with a thoughtful, specific opinion that aligns with your architecture is a better fit than one with a larger brand. "It depends" with no follow-on framework is a warning sign.

Audit etiquette

The single most useful thing to know during an assessment is what to say when an assessor asks about a control your team hasn't fully implemented or can't immediately produce evidence for. The three-sentence script:

"We don't have the right person on the call. Let's circle back on this during hot wash. We will provide you the control information then."

This preserves your ability to produce accurate evidence at the hot wash (the dedicated post-session window for gap discussion) rather than burning a finding on a question you could have answered correctly given preparation time.