Do you need to know who deleted, created or modified a file in One drive or SharePoint ? do you need to check an Admin activity in Office 365 ? do you wanna audit User activity in Exchange Online?
I suggest you start use the Office 365 Protection Center to search the unified audit log to view user and administrator activity in your Office 365 organization.
What you can Audit in the Unified log:
- User activity in SharePoint Online and OneDrive for Business
- User activity in Exchange Online (Exchange mailbox audit logging)
- Admin activity in SharePoint Online
- Admin activity in Azure Active Directory (the directory service for Office 365)
- Admin activity in Exchange Online
Before you start , you have to do the below:
- You must first turn on audit logging before you can start searching the Office 365 audit log. To turn it on, just click Start recording user and admin activity on the Audit log search page in the Protection Center. After you turn it on, a message is displayed that says the audit log is being prepared and that you can run a search in a couple of hours after the preparation is complete. You only have to do this once.
- You can search the Office 365 audit log for activities that were performed within the last 90 days
- It takes up to 15 minutes after an event occurs in SharePoint Online or OneDrive for Business for the corresponding audit log entry to be displayed. It takes up to 12 hours for events in Exchange Online and Azure Active Directory.
Now let’s go and see how can we run an audit report
Step 1: Run an audit log search
- Go to https://protection.office.com.
- Sign in to Office 365 using your work or school account
- In the left Pane go to Reports –> View Reports and then choose Office 365 Audit log report as below
- Now you will get the below screen
- Click on Search and the result will appear like below
- You can now filter the search for some events, you can filter by Date, User, Activity or Details
- Now it’s the time to export your results
See , it is too easy to retrieve the Audit logs
Now, one last thing lets go back to step 4 and check what kind of activities we can audit, Click on the below to get more details
For More Details: Search the audit log in the Office 365 Protection Center