Forum Discussion
Do EOP actions create entries in the Office 365 audit log?
We feed the Office 365 audit log into IBM QRadar for additional analysis, together with logs from firewalls, domain controllers etc. If EOP puts an email into user quarantine or removes a email d...
Use the Office 365 REST reporting web service.
https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984325(v=office.15)
This should have the reports you are looking for. They are not in the audit log.
https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984342%28v%3doffice.15%29
Best, Chris
https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984325(v=office.15)
This should have the reports you are looking for. They are not in the audit log.
https://docs.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984342%28v%3doffice.15%29
Best, Chris