Audit
A searchable log of user and admin activity across Microsoft 365. Standard covers 180 days of retention and core events; Premium extends retention to a year (with add-ons to 10 years), adds high-value crucial events (mailbox access, mail-forwarding-rule changes), and higher log bandwidth for faster forensic investigation.
Favorite this capability
Compliance
Also searchable as: Purview Audit, unified audit log, Advanced Audit
https://webchecks.io/365-license-lookup/feature/audit
Tiers
- Standard
- Premium
Licenses that include this
Enterprise
| License | Tier | String ID |
|---|---|---|
| Microsoft 365 E5 | Standard, Premium | SPE_E5 |
| Microsoft 365 E5 (500 seats min)_HUB | Standard, Premium | Microsoft_365_E5 |
| Microsoft 365 E5 (no Teams) | Standard, Premium | Microsoft_365_E5_(no_Teams) |
| Microsoft 365 E5 Compliance | Premium | INFORMATION_PROTECTION_COMPLIANCE |
| Microsoft 365 E5 Developer (without Windows and Audio Conferencing) | Standard, Premium | DEVELOPERPACK_E5 |
| Microsoft 365 E5 EEA (no Teams) | Standard, Premium | O365_w/o_Teams_Bundle_M5 |
| Microsoft 365 E5 EEA (no Teams) (500 seats min)_HUB | Standard, Premium | O365_w/o_Teams_Bundle_M5_(500_seats_min)_HUB |
| Microsoft 365 E5 EEA (no Teams) with Calling Minutes | Standard, Premium | Microsoft_365_E5_EEA_(no_Teams)_with_Calling_Minutes |
| Microsoft 365 E5 EEA (no Teams) without Audio Conferencing | Standard, Premium | Microsoft_365_E5_EEA_(no_Teams)_without_Audio_Conferencing |
| Microsoft 365 E5 EEA (no Teams) without Audio Conferencing (500 seats min)_HUB | Standard, Premium | Microsoft_365_E5_EEA_(no_Teams)_without_Audio_Conferencing_(500_seats_min)_HUB |
| Microsoft 365 E5 with Calling Minutes | Standard, Premium | SPE_E5_CALLINGMINUTES |
| Microsoft 365 E5 without Audio Conferencing | Standard, Premium | SPE_E5_NOPSTNCONF |
| Microsoft 365 E5 without Audio Conferencing (500 seats min)_HUB | Standard, Premium | Microsoft_365_E5_without_Audio_Conferencing |
| Microsoft 365 E7 | Standard, Premium | MICROSOFT_365_E7 |
| Office 365 E5 | Premium | ENTERPRISEPREMIUM |
| Office 365 E5 EEA (no Teams) | Premium | Office_365_w/o_Teams_Bundle_E5 |
| Office 365 E5 EEA (no Teams) without Audio Conferencing | Premium | Office_365_E5_EEA_(no_Teams)_without_Audio_Conferencing |
| Office 365 E5 Without Audio Conferencing | Premium | ENTERPRISEPREMIUM_NOPSTNCONF |
Microsoft 365 E5
Frontline
| License | Tier | String ID |
|---|---|---|
| Microsoft 365 F5 Compliance Add-on | Premium | SPE_F5_COMP |
| Microsoft 365 F5 Compliance Add-on GCC | Premium | SPE_F5_COMP_GCC |
| Microsoft 365 F5 Security + Compliance Add-on | Premium | SPE_F5_SECCOMP |
Standalone & add-ons
| License | Tier | String ID |
|---|---|---|
| App governance add-on to Microsoft Defender for Cloud Apps | Standard | Microsoft_Cloud_App_Security_App_Governance_Add_On |
| Microsoft 365 A5 for faculty | Standard, Premium | M365EDU_A5_FACULTY |
| Microsoft 365 A5 for Students | Standard, Premium | M365EDU_A5_STUDENT |
| Microsoft 365 GCC G5 | Premium | M365_G5_GCC |
| Microsoft 365 GCC G5 w/o WDATP/CAS Unified | Premium | M365_G5_GOV |
| Microsoft 365 Security and Compliance for Firstline Workers | Premium | M365_SECURITY_COMPLIANCE_FOR_FLW |
| Office 365 A5 for faculty | Premium | ENTERPRISEPREMIUM_FACULTY |
| Office 365 A5 for students | Premium | ENTERPRISEPREMIUM_STUDENT |
| Office 365 Advanced Compliance for GCC | Premium | EQUIVIO_ANALYTICS_GOV |
| Office 365 G5 GCC | Premium | ENTERPRISEPREMIUM_GOV |
| Office 365 GCC G5 without Audio Conferencing | Premium | ENTERPRISEPREMIUM_NOPSTNCONF_NOPBI_GOV |
| Office 365 GCC G5 without Power BI and Phone System | Premium | ENTERPRISEPREMIUM_NOPBIPBX_GOV |
App governance add-on to Microsoft Defender for Cloud Apps
Office 365 Advanced Compliance for GCC