Interpreting SharePoint Online Audit Records

Question

Microsoft says that SharePoint Online and OneDrive for Business offer secure collaboration within Office 365. Good auditing is part of the reason why, but because SharePoint is so chatty when it comes to generating audit records, you might need some help to filter what’s in the audit log to see what’s really important.
https://www.petri.com/sharepoint-online-audit-records

vasilmichev · Answer

Always :)&nbsp;Which doesn't make my point invalid - the Exchange folks should step up and cover all events in the logs, ideally mail flow events too.

vasilmichev · Answer

Well, they can definitely do a better job in filtering out/combining events. But I feel like they are doing a better job compared to Exchange, which has been ignoring certain operations ever since auditing was first introduced in the product.

tonyredmond · Answer

Being a little grumpy tonight Vasil?

tonyredmond · Answer

Not sure about mail flow events because there are tons of those, not all of which are useful. The mail logs seem a better place for the majority of that information.
&nbsp;
As to admin and mailbox auditing, there have been some tweaks to the events captured since their introduction in Exchange 2010, but it could probably do with a review to ensure that all important events are in the net.

Forum Discussion

Interpreting SharePoint Online Audit Records

Share

Resources