Skip to content
Hermes Codex

Audit Log vs Unified Audit Log vs Entra Audit Log

One of the most persistent sources of confusion in Microsoft 365 digital forensics stems from the nomenclature and coexistence of multiple “audit logs”: the Microsoft Entra ID Audit Log, the Microsoft Purview Unified Audit Log (UAL), and Workload-Specific Local Audit Logs (such as the legacy Exchange Admin Audit Log or SharePoint Site Audit).

When an adversary alters directory roles, adds credentials to an application, or manipulates mailbox delegation, records appear across several logging platforms simultaneously. However, they do not arrive at the same time, they do not retain data for the same duration, and their underlying data schemas are not identical. Selecting the incorrect log source during an ongoing incident can lead to false negatives, delayed triage, or catastrophic evidence loss due to retention expiration.

1. Architectural Comparison & Source Systems

Section titled “1. Architectural Comparison & Source Systems”

To understand where evidence resides, an incident responder must trace each log back to its authoritative recording engine:

graph TD
    subgraph "Identity Control Plane"
        ENTRA_CORE[Microsoft Entra ID Directory Engine]
        ENTRA_LOG[Entra Audit Log<br/>Tenant Directory Changes]
        ENTRA_STORE[(Entra Storage<br/>7 to 30 Days)]
    end


    subgraph "Workload Storage & Execution Plane"
        EXO_CORE[Exchange Online Transport & Mailboxes]
        SPO_CORE[SharePoint / OneDrive Subsystems]
        EXO_LEGACY[Legacy Admin Audit Log]
    end


    subgraph "Compliance & Aggregation Plane"
        INGEST[Purview Ingestion Bus]
        UAL_STORE[(Unified Audit Log Store<br/>180 Days to 1 Year+)]
    end


    ENTRA_CORE -->|Real-time: 2-5 min| ENTRA_LOG
    ENTRA_LOG --> ENTRA_STORE


    ENTRA_CORE -->|Replication: 15-60 min| INGEST
    EXO_CORE -->|Publish: 15-45 min| INGEST
    SPO_CORE -->|Publish: 15-30 min| INGEST


    EXO_CORE -->|Local Log: Immediate| EXO_LEGACY


    INGEST --> UAL_STORE

The Three Logging Systems: Taxonomy & Boundary Matrix

Section titled “The Three Logging Systems: Taxonomy & Boundary Matrix”
ParameterEntra ID Audit LogPurview Unified Audit Log (UAL)Workload-Specific Local Logs
Authoritative ScopeIdentity control plane: Users, Groups, Enterprise Apps, Role Assignments, PIM.Cross-workload enterprise activity: Exchange, SharePoint, Teams, Entra ID, Power Platform.Workload boundary only: Exchange Mailbox/Admin audit, SharePoint Site audit.
Ingestion Latency2 to 5 minutes (Near real-time).15 minutes to 24 hours (Asynchronous aggregation).Immediate (local transaction store).
Default RetentionFree: 7 days
P1 / P2: 30 days		Standard: 180 days
Premium / E5: 1 year (extensible to 10y)		Workload dependent (Exchange: 90 days).
Primary API EndpointMicrosoft Graph API:
/v1.0/auditLogs/directoryAudits		Office 365 Management Activity API / Graph Audit APIExchange Online PowerShell:
Search-AdminAuditLog
Query CmdletGet-MgAuditLogDirectoryAuditSearch-UnifiedAuditLogSearch-AdminAuditLog / Get-MailboxAuditLog
Licensing TierFree, P1, P2Purview Audit (Standard / Premium)Native to workload license

2. The Duplication Problem: Traceability Across Systems

Section titled “2. The Duplication Problem: Traceability Across Systems”

When an administrative event occurs in Entra ID—for example, an attacker granting a rogue account the Exchange Administrator role—that single event is captured across multiple systems with distinct representations:

sequenceDiagram
    autonumber
    actor Attacker as Compromised Admin Account
    participant Entra as Entra ID Directory Engine
    participant EntraLog as Entra Audit Log (/auditLogs)
    participant UAL as Purview UAL (RecordType 15)
    participant Defender as Defender XDR (CloudAppEvents)


    Attacker->>Entra: Assigns "Exchange Administrator" to Rogue_User
    Entra->>EntraLog: Writes directoryAudit (Latency: ~2 min)
    Note over EntraLog: Available in Entra Portal & Graph API
    Entra->>UAL: Publishes to Purview Event Bus (Latency: ~30 min)
    Note over UAL: Indexed as RecordType 15 in UAL
    Entra->>Defender: Streams to Advanced Hunting (Latency: ~10 min)
    Note over Defender: Queryable in CloudAppEvents (ActionType: Add member to role.)

Schema Divergence on the Same Event

Section titled “Schema Divergence on the Same Event”

While both logs describe the exact same action, their serialization differs significantly:

{
  "id": "Directory_a4f89d32-28e1-4c12-b891-883109aef102",
  "category": "RoleManagement",
  "correlationId": "5e12a843-ef45-42a1-9a14-8712a45930b1",
  "result": "success",
  "resultReason": "",
  "activityDisplayName": "Add member to role",
  "activityDateTime": "2026-09-15T10:14:22.124Z",
  "loggedByService": "Core Directory",
  "operationType": "Add",
  "initiatedBy": {
    "user": {
      "id": "3d12f890-341a-4f89-91a1-987120adfe01",
      "displayName": "Global Admin Compromised",
      "userPrincipalName": "admin@defense-corp.org",
      "ipAddress": "198.51.100.45"
    }
  },
  "targetResources": [
    {
      "id": "29283109-1004-4b51-9e7f-cisco-seg-sqli",
      "displayName": "Exchange Administrator",
      "type": "Role",
      "modifiedProperties": [
        {
          "displayName": "Role.DisplayName",
          "oldValue": null,
          "newValue": ""Exchange Administrator""
        }
      ]
    },
    {
      "id": "4e9c7a21-82b4-4b51-9e7f-cisco-seg-sqli",
      "displayName": "Rogue_User",
      "type": "User",
      "userPrincipalName": "rogue_user#EXT#@defense-corp.onmicrosoft.com"
    }
  ]
}

3. Scope Exclusivity: What Is ONLY Found in Which Log?

Section titled “3. Scope Exclusivity: What Is ONLY Found in Which Log?”

Understanding telemetry gaps is essential to ensure that responders do not search the wrong repository:

+---------------------------------------------------------------------------------------+
|                              MICROSOFT PURVIEW UAL                                   |
|                                                                                       |
|   +------------------------------------+   +--------------------------------------+   |
|   |          EXCHANGE ONLINE           |   |         SHAREPOINT / ONEDRIVE        |   |
|   |  - MailItemsAccessed (Bind/Sync)   |   |  - FileDownloaded / FileAccessed     |   |
|   |  - New-InboxRule / Set-InboxRule   |   |  - SharingInvitationCreated          |   |
|   |  - SendAs / SendOnBehalf           |   |  - AnonymousLinkCreated              |   |
|   |  - SoftDelete / HardDelete         |   |  - SiteCollectionAdminAdded          |   |
|   +------------------------------------+   +--------------------------------------+   |
|                                                                                       |
|   +------------------------------------+   +--------------------------------------+   |
|   |          MICROSOFT TEAMS           |   |         ENTRA REPLICATION (15)       |   |
|   |  - ChannelAdded / TeamCreated      |   |  - Add member to role                |   |
|   |  - MemberAdded / GuestInvited      |   |  - Consent to application            |   |
|   |  - BotAddedToTeam                  |   |  - Add service principal credentials |   |
|   +------------------------------------+   +--------------------------------------+   |
+---------------------------------------------------|-----------------------------------+
                                                    |
                               Replication Pipeline | (15m - 60m latency)
                                                    v
+---------------------------------------------------------------------------------------+
|                              ENTRA ID AUDIT LOG                                       |
|                                                                                       |
|   - Real-time Directory Audits (~2 min latency)                                       |
|   - Granular TargetResources metadata (Object GUIDs, Directory Schema Extensions)      |
|   - PIM (Privileged Identity Management) Role Activation & Justification Strings      |
|   - Conditional Access Policy Configuration & State Deltas                            |
|   - Password Reset, Self-Service Lifecycle Operations                                 |
+---------------------------------------------------------------------------------------+

Critical Exclusivity Rules for DFIR

Section titled “Critical Exclusivity Rules for DFIR”
  1. Email Item Access & Actions: ONLY found in UAL (RecordType 2). Entra ID has zero visibility into email reads, rule manipulation, or inbox forwarding.
  2. File Downloads & Sharing Links: ONLY found in UAL (RecordType 6). Entra ID records authentication to SharePoint, but never the subsequent file downloads.
  3. PIM Activation Justification: Found with maximum fidelity in Entra Audit Logs. The UAL captures the resulting role assignment, but the detailed PIM request metadata is often stripped or abbreviated.
  4. Historical Investigations (> 30 days): For identity events older than 30 days, responders must use the UAL (or cold storage SIEM). The Entra ID audit log natively rolls over and purges events at day 30 (even on P2 licenses).

4. Operational Triage Decision Framework

Section titled “4. Operational Triage Decision Framework”

During an active incident, apply this decision rubric to determine which log source to query first:

Investigative PhasePreferred SourceSecondary SourceRationale
Phase 1: Immediate Triage (0 - 4h)
Scoping compromised credentials & privilege escalation		Entra ID Audit Log (Graph API)Defender XDR (CloudAppEvents)Sub-5-minute latency allows real-time tracking of attacker directory actions.
Phase 2: Data Impact Assessment
Determining stolen emails and exfiltrated documents		Purview Unified Audit LogWorkload Diagnostics (eDiscovery / Message Trace)Only UAL indexes MailItemsAccessed and FileDownloaded.
Phase 3: Persistence Hunting
Checking for OAuth apps, forwarding rules, federated domains		Both Entra Audit & UALPowerShell scriptsOAuth apps exist in both; inbox rules exist strictly in UAL/Exchange.
Phase 4: Historical Scoping (> 30d)
Evaluating initial compromise from months prior		Purview Unified Audit LogSIEM / Azure Log Analytics cold storageEntra Audit native retention is capped at 30 days.

5. Practical Extraction Workflows

Section titled “5. Practical Extraction Workflows”
Terminal window
# Authenticate to Microsoft Graph with AuditLog.Read.All
Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"


# Query Directory Audit Logs for the last 24 hours (High Speed, Low Latency)
$startTime = (Get-Date).AddDays(-1).ToString("yyyy-MM-ddTHH:mm:ssZ")


$entraEvents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $startTime and category eq 'RoleManagement'" -All


# Parse initiatedBy and TargetResources
$entraEvents | Select-Object ActivityDateTime, ActivityDisplayName, Result, `
    @{N="InitiatedBy"; E={$_.InitiatedBy.User.UserPrincipalName}}, `
    @{N="ClientIP"; E={$_.InitiatedBy.User.IpAddress}}, `
    @{N="Target"; E={($_.TargetResources | Select-Object -First 1).DisplayName}} | `
    Format-Table -AutoSize

6. Forensic Gotchas & Divergence Pitfalls

Section titled “6. Forensic Gotchas & Divergence Pitfalls”

7. Cross-Reference & Operational Mesh

Section titled “7. Cross-Reference & Operational Mesh”