To investigate threats using data from the unified audit log in Microsoft Defender for Cloud Apps, you mus t first bring that audit log data into the scope of Cloud Apps. The unified audit log is a Microsoft 365 / Purview (formerly Office 365) audit log service, which records user and administrator activities across Microsoft 365 services. Microsoft Defender fo r Cloud Apps can ingest those audit records via a Microsoft 365 / Office 365 connector .
Before logs can flow, you need to ensure that auditing is turned on in Microsoft Purview / Microsoft 365, and then connect Microsoft 365 to Defender for Cloud Apps via the "App connectors # Microsoft 365" option under Cloud Apps settings. Once the Microsoft 365 connector (also known as the Office 365 connector) is configured, Defender for Cloud Apps begins ingesting unified audit log events and making them available for investigation, policy enforcement, anomaly detection, etc.
Here's why the other options are not sufficient:
* The Azure connector is used to bring Azure service logs into Cloud Apps, not Microsoft 365 audit logs.
* User enrichment settings add metadata about users (e.g. departments, manager) to Cloud Apps context but do not by themselves bring audit log events.
* Automatic log upload settings (for example, for firewall or proxy logs) support Cloud Discovery or network log ingestion, not the unified audit log fro m Microsoft 365.
Therefore, to use the unified audit log data for threat investigations in Defender for Cloud Apps, you must first configure the Microsoft 365 connector .