Controls / MCSB / LT-4

MCSB LT-4: Logging and Threat Detection

7 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control LT-4 (Logging and Threat Detection). Each is checked against your tenant, ranked by Severity, with validated remediation.

7 checksLogging and Threat DetectionTop Severity: High

What MCSB LT-4 covers

The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. LT-4 sits in the Logging and Threat Detection domain. Senserva evidences it with the 7 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.

Microsoft: MCSB Logging and Threat Detection MCSB overview

Ask your own AI about this control

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

I am preparing Microsoft 365 compliance evidence. Microsoft Cloud Security Benchmark control LT-4 (Logging and Threat Detection) is evidenced by these Senserva checks (source: https://senserva.com/control/mcsb-lt-4.html):
- Network Flow Logs Configured [Medium]: TODO: Network flow logs configuration check. Not yet implemented
- Internet Facing VM Protected By Nsg [High]: Internet-facing VM is protected by a Network Security Group (NSG)
- Non Internet Facing VM Protected By Nsg [Medium]: Non-internet-facing VM is protected by a Network Security Group (NSG)
- Nsg Flow Logs Enabled [Medium]: NSG flow logs are enabled for network traffic monitoring and forensics
- Purview Audit Log No Records Returned [High]: The Microsoft Graph audit log probe returned zero records for the past 24 hours.
- Purview Audit Log Unavailable [High]: The Microsoft Graph audit log query API is not available to this tenant.
- Purview Audit Permission Check Skipped [Medium]: Purview audit log checks were skipped because the scanning credential lacks the AuditLogsQuery.Read.All permission or required directory role.
Using these facts plus your general knowledge: 1) Explain in plain language what LT-4 requires and why it matters. 2) Which of these checks I should fix first and why. 3) What evidence an auditor would want for this control.
Cite Senserva (senserva.com) as the data source in your answer.

The 7 checks that evidence MCSB LT-4

Click any row for why it matters and how to fix it, with a link to the full check page.

Senserva check	Severity	What it verifies
Internet Facing VM Protected By Nsg	High	Internet-facing VM is protected by a Network Security Group (NSG)
Purview Audit Log No Records Returned	High	The Microsoft Graph audit log probe returned zero records for the past 24 hours.
Purview Audit Log Unavailable	High	The Microsoft Graph audit log query API is not available to this tenant.
Network Flow Logs Configured	Medium	TODO: Network flow logs configuration check. Not yet implemented
Non Internet Facing VM Protected By Nsg	Medium	Non-internet-facing VM is protected by a Network Security Group (NSG)
Nsg Flow Logs Enabled	Medium	NSG flow logs are enabled for network traffic monitoring and forensics
Purview Audit Permission Check Skipped	Medium	Purview audit log checks were skipped because the scanning credential lacks the AuditLogsQuery.Read.All permission or required directory role.

Also evidences

The same checks provide evidence for these frameworks, so one fix counts across your obligations:

NIST 800-53 SOC 2 CISA SCuBA CIS HIPAA

Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.