Cross-posting my comment on this in the /r/programming thread about the vulnerability: https://www.reddit.com/r/programming/comments/126dwym/azure_active_directory_misconfiguration_exploited/jed00xe/

TL;DR: Microsoft disables audit logging by design precisely when it is the most needed (multi-tenant Enterprise Apps).