Enable AUdit Logging in the Security and Compliance Center

Question

I am trying to figure out how to enable audit logging in the security and compliance center. I have only seen resources online talking about turning on the audit log search capabilities but not how to turn the audit logs in general for a company just starting to use the security and compliance center.

Answer 1

Should be front and center in the SCC when you access it:

https://learn.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide

https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

You (or another admin) must first turn on audit logging before you can start searching the audit log. To turn it on, click Turn on auditing on the Audit log search page in the Security & Compliance Center. (If you don't see this link, auditing has already been turned on for your organization.) After you turn it on, a message is displayed that says the audit log is being prepared and that you can run a search in a couple of hours after the preparation is complete. You only have to do this once. For more information, see Turn audit log search on or off.

You can always verify with powershell

Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled

Should show TRUE