Import your M365 Tenant's Historical Audit Log Entries / Records
If you’ve already implemented Audit Vault for M365 for your Organization and Microsoft 365 (Office 365) Tenant - your go-forward and current audit logs are already being protected and retained in Audit Vault for M365. In addition, when you set up your account in Audit Vault for M365 the last 7 days of your audit log history are automatically pulled in to be protected.
Go-forward audit log protection date is the original date of when you signed up for Audit Vault for M365 to securely protect and retain your M365 audit log data.
Historical audit log entries are any historical audit log entries or records that existed prior to when you signed up for Audit Vault for M365 (before your go-forward protection date). It is possible for Audit Vault for M365 to pull in all historical audit log entries and records that may exist in your M365 Tenant.
Audit Vault for M365 can securely protect and retain both of your Microsoft 365’s (Office 365) go-forward audit log protection and historical audit log entries! In this guide we provide an overview of why and how you can pull back all of your historical audit log entries.
Why pull in all of your historical audit log entries:
You are happy with your go-forward audit log protection that you now already have in place with Audit Vault for M365. Now, your organization wants to securely preserve and retain all of your M365 Tenant’s historical audit log entries for regulatory, compliance or security reasons. By default, Microsoft keeps your audit log data for only up to 90 days (180 days after Nov 1, 2023) for E3 user licenses, and only up to 1 year for E5 user licenses. After those dates your valuable audit log data and history will be lost forever.
Audit Vault for M365 allows you to avoid losing your audit data (audit history) regardless of your Microsoft license types. Audit Vault for M365 enables a secure Audit Vault to preserve and maintain your audit log history for your organization’s Microsoft 365 Tenant for as long as you require – it doesn’t matter if some of your users are E1, E3, or E5 – we preserve it all allowing you to even pull in historical audit data that may exist prior to when you first enabled Audit Vault for your Tenant (prior to your go-forward audit log protection date).
Prerequisites:
Below is a general list of pre-requisites you want to have ready in order to get started.
- You have successfully configured Audit Vault for M365 for your organization and your Microsoft 365 Tenant.
- You are ready to import your M365 Tenant’s Historical Audit Log Entries.
- If your account is not the Microsoft 365 Global Administrator or Entra Administrator for your organization – please have your Microsoft 365 Global Administrator or Entra Administrator ready to assist with granting access to this App.
- Have around 15 minutes to read this guide and start importing all of your historical audit log entries.
How to Securely Import and Protect Your Historical Audit Log Entries:
- You must have Tenant Administrator Role or higher access in the App in order to access this function.
- Browse to the Tenant > Tenant History page in the App.
- Check to see if you or someone on your Team has already started or completed the Historical Audit Log import process. If the Historical Audit section shows as “in-process” or “completed” then no further action is required since the action is already in-process or completed.
- If the Historical Audit import process has not yet started.
- If you are in your 14 day “trial” period, you must convert your account to a paid “active” in order to access this functionality. You can click “Start Paid Subscription”.
- If your account is already “active” you may continue. Please click “Historical Data Setup”.
-
Configure and setup your Historical Audit Import
-
Please have one of your Microsoft 365 Global Administrators ready to grant access to this App for importing your historical audit log data.
- If you aren’t your organization’s Microsoft 365 Global Administrator, in our experience it’s easiest to schedule a screenshare on Teams and have them sign-in and approve the request. It literally takes 1 minute.
-
Click on the option “Grant Consent”.
- This will open up the Microsoft 365 sign-in page asking for a M365 Global Administrator to sign-in.
- Have your M365 Global Administrator sign-in.
- Once signed-in, you will be presented with Microsoft’s “Permission Requested” screen.
- It will show the “ECM Insights : Historical Audit History Importer” application and the read-access it is requesting to be granted access for in your Tenant.
- Click “Accept” will grant the App read-access to your M365 Tenant’s historical audit log information.
- You now need to have your Microsoft 365 Global Administator or Entra Administrator manually add access from Entra (Azure) Admin Center.
- Log into your Tenant's Entra Admin Center
- Navigate to Identity
- Click on Roles & Admins
- Search for Exchange Administrator
- Click on Exchange Administrator
- Click on Add Assignment
- Search for “ECM Insights : Historical Audit History Importer”
- Click Add
- Click “Test Connection” button to ensure that the above steps were completed successfully.
- If you have regular E3 or E5 or equivalent licenses this means you only have up to 180 days or 1 year of audit data respectively. Please jump ahead right to the next step below. If you have extended audit log licenses and are sure you have > 1 year of audit log history - please first contact our Support Team and indicate how far back you want us to attempt to retrieve from your Tenant before you proceed with the next step (dependent on your Microsoft User licenses) – we will then configure a longer historical date to pull back from and then you may proceed with the next step below.
- Click on the option “Start Import”.
- This action will begin your Historical Audit Import.
- On success of starting the import jobs, a button will be displayed “Back to Tenant History Page”. Click on the button and it will take you back to your Tenant History Page.
-
Monitor your Import Progress.
- From your Tenant History Page you can now view the import Job Status and % completion.
- Your historical audit log history is now being loaded.
- Please note that this operation may take a long time to complete due to Microsoft throttling behavior (dependent on volume of audit logs your organization may have).
-
Please have one of your Microsoft 365 Global Administrators ready to grant access to this App for importing your historical audit log data.
Congratulations - when the Audit Log History Imports have successfully completed you will see a section with your “Compliance Certificate” proving your Microsoft 365 historical audit history was imported and is securely retained + preserved + protected in Audit Vault for M365.
Note: Audit Vault for M365 protects your organization and allows you to pull back all available historical audit data that may exist prior to when you first enabled Audit Vault for your Tenant. If your Microsoft User licenses have audit logs that have passed the 90, 180 day or 1 year audit log preservation dates those audit logs may have already been automatically purged by Microsoft. Audit Vault for M365 can only pull back what audit logs that Microsoft has available. If your organization needs to retain your Microsoft 365 audit log history - it is of utmost importance to start your Audit Log History Imports with Audit Vault for M365 to ensure your audit history is securely retained / vaulted as soon as possible. Every day you wait without leveraging Audit Vault for M365 means you could be losing more of your vital audit log history. Audit Vault for M365 securely retains + preserves + protects your critical audit log event data to ensure you can gain insights and further investigate user activities if and when required for compliance, regulatory or security purposes.
If you have any questions or require assistance, please contact support by clicking the button below.