Something odd happened in a mailbox last spring, and nobody can say when it started.
That is usually the part that stings. Not the missing money. The missing timeline. You know something happened. You cannot prove when, or who, or what they touched first.
Microsoft 365 has a feature that would have answered most of that. It is called the audit log. It records activity inside your tenant: who created a mail rule, who shared a file with a link that skips the sign-in, who added themselves as an administrator, who deleted a mailbox, who signed in and from where.
It comes with Microsoft 365 Business Basic, Business Standard, and Business Premium. Microsoft's own licensing table lists it as included on all three.
And on those same three plans, Microsoft ships it turned off.
Included, and not running
The documentation is unusually blunt about this. Auditing is not enabled by default for small and medium business licenses, including Business Basic, Business Standard, and Business Premium. Someone has to turn it on.
That is not a trick or a hidden upsell. It is a default that made sense to someone at some point, and it has been quietly costing small organizations the one record they needed. Most tenants I look at were set up by whoever was fastest, and that person had other things on their mind.
So the setting sits there. Paid for. Off.
What it would have shown you
The audit log does not stop anything. It is not a lock. It is closer to a receipt.
Here is the kind of thing it holds. An inbox rule appears that forwards a specific customer's invoices to an outside address. A finance folder gets shared with a link that does not ask anyone to sign in. A new account is granted administrator rights at eleven at night. A mailbox is deleted the week someone gives notice.
Any one of those can be legitimate. That is the point. The log is how you tell the difference between a new hire doing their job and someone setting up a place to keep watching after they leave.
Without it, the answer to "when did that rule get created" is a shrug. With it, you have a date, an account, and an IP address.
Microsoft is careful to say the logs are not a preventive measure. They are not. They are what you read afterward, and afterward is exactly when a small business has the least information and the most questions.
The record expires
This is the second half of the problem, and it catches people who did turn auditing on.
The standard audit log keeps 180 days. Before October 2023 it was 90 days, and logs created before that date still expire at 90. Anything older than the window is gone. Not archived, not hidden behind a support ticket. Gone.
Now think about how a small business actually discovers a problem. Not on day two. It gets discovered when a customer calls about an invoice they never received, or when a bank asks about a payment that does not match, or when someone finally notices that the reply-to address on outgoing mail is wrong. That can easily be seven or eight months in.
By then, the record of how it started has expired. You are left with the outcome and no way back to the cause.
Two minutes to find out where you stand
You do not need to learn a new tool to answer this. You need one question asked.
The check is in the Microsoft Purview portal. Open the Audit solution. If auditing is not running, the page shows a banner asking you to start recording user and admin activity. That banner is your answer.
If you would rather have a yes or no in writing, whoever manages your tenant can run one command in Exchange Online PowerShell: Get-AdminAuditLogConfig and look at UnifiedAuditLogIngestionEnabled. True means it is recording. False means it is not.
One thing worth knowing before you turn it on and relax. Enabling it can take up to an hour to take effect, and events can take several more hours to become searchable. It does not backfill. Nothing from before the moment you enable it will ever appear, because it was never written down.
Why bother
Because the question is not whether you will need the log. The question is whether it will still exist when you do.
Most of what protects a small business is unglamorous. A restore that has actually been tested. A phone call to confirm a change in bank details. A log that has been quietly running for two years when someone finally asks it a hard question.
You are already paying for this one. It is the cheapest kind of improvement available to you: a setting that is already included, already sitting in your tenant, waiting for someone to switch it on before the day you need it.
Ask whoever handles your Microsoft 365 to confirm the status this week. If the answer is no, turn it on and leave it alone. If the answer is yes, ask when it was turned on, because that date is the edge of everything you can prove.