Are administrator privileged access activities audited?
Auditing administrative activity costs almost nothing and decides whether an incident can be reconstructed. Carriers ask because the answer determines the cost of their own forensics.
What the carrier is actually asking
The carrier is asking whether privileged actions produce a durable record: who elevated, what they changed, from where, and when. It is asking about capture and about retention, because a log that rolls over in thirty days does not cover an intrusion that began four months earlier.
Why it is underwritten
After a loss, the carrier pays for forensics. If administrative activity was never logged, or the retention window closed before the investigation started, the investigation cannot establish scope. That drives cost up and, for regulated data, forces the insured toward the most conservative notification position because it cannot prove what was not accessed. Underwriters price that uncertainty.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Microsoft 365 and Azure both capture this natively, but neither retains it long by default, and one of them has to be switched on.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Microsoft 365 | Unified audit log enabled tenant-wide, in Purview | Enabled. It is the record of administrative and user activity across the workloads, and it can be off |
| Microsoft 365 | Audit log retention policy, and mailbox audit retention | Retention beyond the default, sized to how long an intrusion can plausibly go unnoticed rather than to the licence minimum |
| Entra ID | Directory audit logs and sign-in logs, exported to a Log Analytics workspace or SIEM | Exported, because in-portal retention is short and cannot be extended in place |
| Azure | Activity log diagnostic settings at subscription scope | Sent to a workspace or storage account with a retention period that matches your investigation window |
| Entra ID | Privileged Identity Management activation history | Elevation events recorded with justification, so privileged actions can be tied to an approved activation |
Most tenants capture. Fewer retain. If your directory audit log holds thirty days and your incident response plan assumes ninety, you have a gap that only becomes visible during an investigation, which is the worst moment to discover it.
What a defensible yes requires
- The unified audit log is enabled and has been for long enough to cover your stated retention.
- Directory and Azure activity logs are exported to a durable store rather than left at portal defaults.
- Retention is set deliberately, with a stated number you can defend, commonly a year for privileged activity.
- Privileged elevation carries justification, so the log answers why as well as what.
- Someone reads the logs, or alerts are configured, because an unread log is evidence rather than a control.
How this answer goes wrong
The failure is almost always retention rather than capture. An organisation answers yes on the strength of the portal showing recent administrative events, and discovers during an investigation that the window covers a fraction of the intrusion. The second failure is scope: capturing directory activity while the Azure subscription activity log was never given a diagnostic setting, so resource-plane changes are unrecorded.
Frequently asked
How long should logs be kept?
Long enough to cover the time between compromise and detection, which industry data still puts in the range of months rather than weeks. A year of privileged activity is a common and defensible answer.
Is the default retention enough?
Rarely. Portal defaults are sized for operational troubleshooting, not for forensics. Export is the mechanism that turns a default into a defensible answer.
Do we need a SIEM to answer yes?
No. A Log Analytics workspace with a set retention answers the question. A SIEM helps with the separate question about centralisation and monitoring.
Does this cover service principals?
It should. Application and workload identities perform privileged actions, and their activity is captured in the same logs. Excluding them from monitoring is a common blind spot.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture