To enable the audit log via PowerShell, follow these steps:
- Connect to Exchange Online PowerShell:
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential (Get-Credential) -Authentication Basic -AllowRedirection
Import-PSSession $Session
- Once connected to Exchange Online, run the following commands:
Enable-OrganizationCustomization
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
The audit log will be enabled, but it may take some time before events start appearing.