Microsoft 365 Audit Logs and Petra

What Are Microsoft 365 Audit Logs?

Microsoft 365 Unified Audit Logs are a record of activity across your Microsoft 365 environment — sign-ins, email actions, file access, admin changes, and more. They are the foundation of Petra's ability to detect and investigate security incidents. Without them, Petra has limited visibility into what has happened (or is happening) in your environment.

Why Audit Logs Matter

Petra relies on audit logs to:

• Detect compromises by analyzing sign-in patterns, suspicious email activity, and unauthorized changes

• Investigate incidents by building a timeline of attacker actions

• Monitor your environment in real time for ongoing threats

If audit logs are not enabled, Petra cannot see the historical activity needed to do its job effectively.

How Petra Uses Audit Logs

Autopsy (Post-Compromise Investigation)

When you onboard a tenant for Autopsy, Petra looks back through up to 6 months of audit log history to find evidence of compromise. This includes sign-in activity, email forwarding changes, admin actions, and more.

Because Autopsy depends on historical data, audit logs must already be enabled for it to work. If Petra detects that audit logs are not turned on for an Autopsy tenant, the tenant will automatically be moved to Live Monitoring instead, and you will receive an additional Autopsy slot to use with a different tenant.

Live Monitoring

For ongoing monitoring, Petra continuously ingests audit log data as it is generated. This allows Petra to detect threats in real time and alert you as soon as suspicious activity is identified.

How Petra Checks and Enables Audit Logs

During Onboarding

When you first connect a tenant, Petra checks whether the Unified Audit Log is enabled. You will see this as a step in the onboarding checklist:

1. Petra app installed

2. Petra app has permissions

3. Unified Audit Log is enabled

If Petra can confirm audit logs are on, you will see a green checkmark. If they are off, you will see a message explaining the situation. In some cases, Petra may not be able to determine the status right away — if so, you will see a message letting you know that Petra will keep checking and will enable them for you if needed.

Automatic Enablement

After onboarding, Petra automatically checks the audit log status for your tenant on a regular basis. If audit logs are not enabled, Petra will attempt to turn them on for you by enabling the Unified Audit Log setting in your Microsoft 365 environment. This happens automatically — no action is needed on your part.

Once audit logs are successfully enabled, Petra updates the status and begins ingesting data.

How to Check Audit Log Status

You can see the status of your tenant's audit logs in a few places:

• Onboarding checklist — During setup, the validation step will show whether the Unified Audit Log is enabled, disabled, or still being checked.

• Tenant status tracker — After onboarding, your tenant's progress tracker shows stages including "Collecting Audit Logs." If your tenant is stuck on this stage, it may indicate an issue with audit log availability.

If there is a problem with audit logs on your tenant, Petra will surface messaging to let you know.

Important Limitation: No Lookback Before Audit Logs Were Enabled

Petra cannot see activity that occurred before audit logs were turned on. Microsoft does not retroactively generate audit log data, so if audit logs were enabled on January 15, there is no record of what happened on January 14 or earlier.

This is especially important for Autopsy investigations. If a compromise began before audit logs were enabled, Petra will not have a complete picture of the attacker's initial access or early actions. In these cases, Petra will let you know that the start of the attacker's access is uncertain — either because audit log data was lost due to retention limits (approximately 6 months) or because audit logs were enabled after the compromise was already underway.

What Petra Can Still Detect

Even without full audit log history, Petra can detect latent signs of a previous compromise by examining the current state of your environment. These include:

• Malicious inbox rules — Attackers often create email forwarding or filtering rules to intercept messages. Petra reads these directly from your mailboxes, regardless of when they were created.

• Suspicious app registrations and enterprise apps — Unauthorized OAuth apps or service principals that an attacker may have installed for persistent access.

• Mailbox permission changes — Unexpected delegated access or send-on-behalf permissions.

These are known as persistence mechanisms — footholds that an attacker leaves behind to maintain access. Petra can identify these even when the original audit log trail is unavailable, because they are read from the current configuration of your environment rather than from historical logs.

Summary

If you have questions about audit log status for your tenant, reach out to our support team and we can help verify your setup.