Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
General

Microsoft Xdr Auditing

4 September 2026Doc update+23 / −15 lines

In brief

The page broadens references from Microsoft Defender XDR to Microsoft Defender, clarifies that audit logs can be searched in the Defender or Purview portals, updates navigation and retention guidance, and removes the PowerShell query example.

What Defender admins need to know

Admins can use the revised portal instructions and links when investigating audited activities; no required configuration change is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • m365-security
  • tier3 ms.topic: how-to ms.date: 06/15/07/02/2026 appliesto:
  • Microsoft Defender for Endpoint Plan 2
  • Microsoft Defender XDR ms.custom: sfi-ga-nochange, msecd-doc-authoring-10141016 ai-usage: ai-assisted

#customer intent: As a SOC analyst, I want to learn how to use the audit log to search for Microsoft Defender XDR activities to help with investigation.

[!INCLUDE Microsoft Defender XDR rebranding]

The audit log helps you investigate specific activities across Microsoft 365 services. In the Microsoft Defender portal, Microsoft Defender XDR and Microsoft Defender for Endpoint activities are audited.

Some of the audited activities audited are:include:

  • Changes to data retention settings
  • Changes to advanced features
  • Create\edit custom detection rules
  • Assign user to an incidents

For a complete list of Microsoft Defender XDR activities that are audited, see Microsoft Defender activities and Microsoft Defender for Endpoint activities.

Auditing is automatically turned on for Microsoft Defender XDR.Defender. Features that are audited are logged in the audit log automatically. Auditing can also collect audit logs from GCC environments.

Prerequisites

Microsoft Defender uses the Microsoft Purview auditing solution. Before you can look at the audit data in the Microsoft Defender portal, you need to turn on auditing in the Microsoft Purview portal. For more information, see Turn auditing on or off.

Search the audit log

You can search the audit log from the Microsoft Defender portal or the Microsoft Purview compliance portal. For detailed compliance portal instructions, see Search the audit log in the compliance portal or go. Audit log record retention is based on Microsoft Purview retention policies. For more information, see Manage audit log retention policies.

Follow these steps to search the audit log:

  1. Go to the Microsoft Defender portal's Audit page. You can also open the Purview compliance portal and select Audit.

    :::image type="content" source="media/microsoft-xdr-auditing/unified-audit-log-xdr.png" alt-text="Screenshot of the unified audit log page in Microsoft Defender XDR " lightbox="media/microsoft-xdr-auditing/unified-audit-log-xdr.png":::

For step-by-step instructions, see Search the audit log in the compliance portal.

AuditHow long audit log record retention is basedrecords are kept depends on your Microsoft Purview retention policies. For more information,To learn more, see Manage audit log retention policies.

Microsoft Defender XDR audit log activity reference

For a list of all events that are logged for user and admin activities in Microsoft Defender XDR in the Microsoft 365 audit log, see:

Microsoft Defender for Endpoint audit log activity reference

For a list of all events that are logged forThe Microsoft 365 audit log records user and admin activities in Microsoft Defender for Endpoint in the Microsoft 365 audit log,Endpoint. For details, see:

Search for events using a PowerShell script

You can use the following PowerShell code snippet to query the Office 365 Management API to retrieve information aboutfor Microsoft Defender XDR events. The script connects to Exchange Online PowerShell, establishes a remote session, and then searches the unified audit log for thea specified record type and date range.

$cred = Get-Credential

For more information, see [Use a PowerShell script to search the audit log](/purview/audit-log-search-script)

<a name="see-also"></a>
## See alsoRelated content

- [Detailed properties in the audit log](/purview/audit-log-detailed-properties)
- [Export, configure, and view audit log records](/purview/audit-log-export-records)