An investigator is evaluating a client's Microsoft 365 deployment using the web portals and has identified that the Purview compliance portal states…

Microsoft enabled Unified Audit Logging by default for all new Microsoft 365 tenants created on or after October 17, 2018. The tenant in this scenario was established in December 2021, well after this change. Therefore, the default configuration for this tenant would be to have auditing enabled. The message stating that the logs are not enabled indicates a deviation from the default state. This means an administrator must have taken explicit action to disable the service, most likely via the Set-AdminAuditLogConfig PowerShell cmdlet. The other options are inconsistent with the service's default behavior and functionality.

B. License was downgraded lower than an E5 license Basic audit logging is available in most enterprise licenses, not just E5. A downgrade would not disable the core feature.
C. Tenant is configured to forward logs externally Configuring log forwarding to an external SIEM does not disable the native Unified Audit Log within the Microsoft 365 ecosystem.
D. Default configuration, service was never enabled This is incorrect. The default configuration for any tenant created after October 17, 2018, is to have auditing enabled. ---

1. Microsoft Corporation. (2023, October 18). Turn auditing on or off. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/audit-log-enable-disable

Reference Details: In the "Turn on auditing" section, the document states, "Auditing is turned on by default for Microsoft 365 and Office 365 enterprise organizations. This applies to organizations that were created on or after October 17, 2018." This directly contradicts option D and supports the conclusion that the service must have been explicitly disabled.

2. Microsoft Corporation. (2023, October 18). Set-AdminAuditLogConfig. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/powershell/module/exchange/set-adminauditlogconfig

Reference Details: The documentation for this PowerShell cmdlet describes the -UnifiedAuditLogIngestionEnabled parameter. Setting this parameter to $false explicitly disables the Unified Audit Log, which is the action described in the correct answer (A).

3. Microsoft Corporation. (2023, November 27). Microsoft Purview Auditing solutions. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/audit-solutions-overview

Reference Details: The subscription requirements table shows that "Audit (Standard)" is available for a wide range of subscriptions, including Office 365 E1/E3 and Microsoft 365 E3, not just E5. This refutes the claim in option B that a license downgrade below E5 would be the cause.