adminAuditLogConfig

Admin Audit Logging. Settings that control logging of administrator actions. The adminAuditLogConfig singleton lives under /exchange/v1.0/adminAuditLogConfig in the eDiscovery & audit category.

Fact	Value
Path	/exchange/v1.0/adminAuditLogConfig
Category	eDiscovery & audit
Tier	Tier 9, Hybrid and organization
Read role	OrganizationConfig.Read.All (Community)
Write role	OrganizationConfig.ReadWrite.All (Enterprise)
Backing cmdlets	Get-AdminAuditLogConfig, Set-AdminAuditLogConfig

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/adminAuditLogConfig	GET /adminAuditLogConfig - fetch the tenant audit-log singleton.	OrganizationConfig.Read	Community
PATCH	/exchange/v1.0/adminAuditLogConfig	PATCH /adminAuditLogConfig - update the tenant audit-log singleton. Body keys map 1:1 to Set-AdminAuditLogConfig parameters (adminAuditLogEnabled, adminAuditLogCmdlets, adminAuditLogParameters, etc.). Returns 200 + the post-Set singleton.	OrganizationConfig.ReadWrite	Enterprise

GET /exchange/v1.0/adminAuditLogConfig

GET /adminAuditLogConfig - fetch the tenant audit-log singleton.

Backing cmdlet: Get-AdminAuditLogConfig. Role: OrganizationConfig.Read (Community).

Get the admin audit log configuration

Returns the tenant-wide admin audit log configuration singleton, backed by the Get-AdminAuditLogConfig cmdlet. There is exactly one instance per organization, so no key is required.

GET /exchange/v1.0/adminAuditLogConfig HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#adminAuditLogConfig",
  "Id": "Admin Audit Log Settings",
  "Identity": "Admin Audit Log Settings",
  "AdminAuditLogEnabled": true,
  "AdminAuditLogCmdlets": [
    "*"
  ],
  "AdminAuditLogParameters": [
    "*"
  ],
  "AdminAuditLogExcludedCmdlets": [],
  "AdminAuditLogAgeLimit": null,
  "UnifiedAuditLogIngestionEnabled": true,
  "LoadBalancingMailboxAuditingEnabled": false
}

Notes: Admin audit logging is enabled by default and cannot be disabled in Exchange Online; AdminAuditLogEnabled is always true. The wildcard values for AdminAuditLogCmdlets/AdminAuditLogParameters mean all cmdlets and parameters are logged.

PATCH /exchange/v1.0/adminAuditLogConfig

PATCH /adminAuditLogConfig - update the tenant audit-log singleton. Body keys map 1:1 to Set-AdminAuditLogConfig parameters (adminAuditLogEnabled, adminAuditLogCmdlets, adminAuditLogParameters, etc.). Returns 200 + the post-Set singleton.

Backing cmdlet: Set-AdminAuditLogConfig. Role: OrganizationConfig.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
unifiedAuditLogIngestionEnabled	body
dryRun	query	bool (switch)

Toggle unified audit log ingestion

Update the tenant-wide admin audit log singleton via Set-AdminAuditLogConfig. Block 4 live-verify on the dev tenant 2026-05-28 confirmed that 8 of the 9 params documented in Wiki (every Admin*-AuditLog* field + LogLevel + Name + TestCmdletLoggingEnabled) are NOT supported on the cloud EXO runspace - they work only on on-prem hybrid PowerShell. The only field that passes through to the cloud cmdlet is unifiedAuditLogIngestionEnabled - the toggle for tenant-wide unified audit log ingestion (the Purview audit log search prereq). Other admin-audit toggles are managed via Purview portal or Microsoft Graph, not Exchange PowerShell.

PATCH /exchange/v1.0/adminAuditLogConfig HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "unifiedAuditLogIngestionEnabled": true
}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#adminAuditLogConfig",
  "Id": "Admin Audit Log Settings",
  "Identity": "Admin Audit Log Settings",
  "AdminAuditLogEnabled": true,
  "AdminAuditLogCmdlets": [
    "*"
  ],
  "AdminAuditLogParameters": [
    "*"
  ],
  "AdminAuditLogExcludedCmdlets": [],
  "AdminAuditLogAgeLimit": "90.00:00:00",
  "UnifiedAuditLogIngestionEnabled": true
}

Related: GET /exchange/v1.0/adminAuditLogConfig

?dryRun=true previews of any write stay on Community.