Data-35037: Purview Audit Logging Enabled (#848)

* initial commit for spec 35037 test

* updated test with correct properties

* added logic to skip test in case of command failure(sharepoint cmd)

* removed skip reason NoExchangeAccess

Author: sandeepjha000

src/powershell/tests/Test-Assessment.35037.md

@@ -0,0 +1,22 @@
+Purview audit logging is the foundational mechanism for detecting and investigating data security incidents, unauthorized access attempts, and compliance violations across Microsoft 365. Without unified audit logging enabled, organizations lose visibility into who accessed sensitive data, when policy violations occurred, and what administrative actions were taken. Audit logs are critical for forensic investigations, regulatory compliance, eDiscovery, insider threat detection, and demonstrating controls to auditors and regulators. Disabling or failing to enable audit logging creates a "blind spot" where threat actors can operate undetected, policy violations go unnoticed, and incident response becomes impossible due to lack of evidence. Organizations must enable Purview audit logging to maintain visibility across Exchange Online, SharePoint Online, OneDrive, Teams, and other services, ensuring that all user and admin activities are captured and available for investigation. Without audit logging enabled, organizations cannot meet compliance requirements (SOX, HIPAA, GDPR, etc.) that mandate activity logging for sensitive operations.
+
+**Remediation action**
+
+To enable Purview audit logging:
+
+1. Sign in as a Global Administrator or Compliance Administrator to the [Microsoft Purview portal](https://purview.microsoft.com)
+2. Navigate to **Audit** > **New Search**
+3. If prompted that auditing is not enabled, select **Turn on auditing**
+4. Confirm the prompt to enable unified audit logging
+5. Wait 1-2 hours for audit log ingestion to become active
+6. Via PowerShell:
+   - Connect to Exchange Online: `Connect-ExchangeOnline`
+   - Verify audit is enabled: `Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled`
+   - If disabled, audit logging is enabled by default for most organizations; if not, contact Microsoft Support
+7. Search audit logs to verify they are being collected: Navigate to **Audit** > **Audit search** and run a test search
+8. Configure retention policy (default is 90 days, E5 can extend to 180 days or longer with extended retention)
+
+For more information:
+- [Enable or disable audit log search](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable)
+- [Search the audit log](https://learn.microsoft.com/en-us/purview/audit-search)
+- [Audit log retention policies](https://learn.microsoft.com/en-us/purview/audit-log-retention-policies)

src/powershell/tests/Test-Assessment.35037.ps1

@@ -0,0 +1,91 @@
+<#
+.SYNOPSIS
+    Purview Audit Logging Enabled
+#>
+
+function Test-Assessment-35037 {
+    [ZtTest(
+        Category = 'Data Security Posture Management',
+        ImplementationCost = 'Low',
+        MinimumLicense = ('Microsoft 365 E3'),
+        Pillar = 'Data',
+        RiskLevel = 'High',
+        SfiPillar = 'Protect tenants and production systems',
+        TenantType = ('Workforce','External'),
+        TestId = 35037,
+        Title = 'Purview audit logging enabled',
+        UserImpact = 'Low'
+    )]
+    [CmdletBinding()]
+    param()
+
+    #region Data Collection
+    Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose
+    $activity = 'Checking Purview audit logging configuration'
+
+    # Query Q1: Get unified audit logging configuration
+    Write-ZtProgress -Activity $activity -Status 'Getting audit log configuration'
+
+    $errorMsg = $null
+    $auditConfig = $null
+
+    try {
+        $auditConfig = Get-AdminAuditLogConfig -ErrorAction Stop
+        Write-PSFMessage "Retrieved audit log configuration" -Level Verbose
+    }
+    catch {
+        $errorMsg = $_
+        Write-PSFMessage "Error querying audit log configuration: $_" -Level Error
+    }
+    #endregion Data Collection
+
+    #region Assessment Logic
+    if ($errorMsg -or -not $auditConfig) {
+        Write-PSFMessage 'Not connected to Exchange Online.' -Level Warning
+        Add-ZtTestResultDetail -SkippedBecause NotConnectedExchange
+        return
+    }
+
+    $passed = $false
+
+    if ($auditConfig.UnifiedAuditLogIngestionEnabled -eq $true) {
+        $passed = $true
+        $testResultMarkdown = "✅ Purview Audit Logging is ENABLED and all activities across Microsoft 365 services are being captured and logged for investigation and compliance purposes.`n`n%TestResult%"
+    }
+    else {
+        $passed = $false
+        $testResultMarkdown = "❌ Purview Audit Logging is DISABLED, creating a critical visibility gap where unauthorized access, policy violations, and security incidents cannot be detected or investigated.`n`n%TestResult%"
+    }
+
+    #endregion Assessment Logic
+
+    #region Report Generation
+    $mdInfo = ''
+
+    # Show audit configuration only if we have data
+    if ($null -ne $auditConfig) {
+        $mdInfo += "`n`n### [Audit logging status](https://purview.microsoft.com/audit)`n"
+        $mdInfo += "| Configuration property | Value |`n"
+        $mdInfo += "| :--- | :--- |`n"
+
+        $auditStatus = $auditConfig.UnifiedAuditLogIngestionEnabled
+        $ageLimit = if ($auditConfig.AdminAuditLogAgeLimit) { $auditConfig.AdminAuditLogAgeLimit } else { 'Not configured' }
+        $organizationId = if ($auditConfig.OrganizationId) { Get-SafeMarkdown -Text $auditConfig.OrganizationId } else { 'N/A' }
+
+        $mdInfo += "| Unified audit log ingestion enabled | $auditStatus |`n"
+        $mdInfo += "| Audit log age limit | $ageLimit |`n"
+        $mdInfo += "| Organization ID | $organizationId |"
+    }
+
+    $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
+    #endregion Report Generation
+
+    $params = @{
+        TestId = '35037'
+        Title  = 'Purview audit logging enabled'
+        Status = $passed
+        Result = $testResultMarkdown
+    }
+
+    Add-ZtTestResultDetail @params
+}