Forum Discussion
Search the audit log in the Office 365 Security & Compliance Center
If U need to find if a user viewed a specific document or purged an item from their mailbox, than U can use the O365 Security & Compliance Center to search the unified audit log to view user and administrator activity in your O365 organization.
Why a unified audit log? Because U can search for the following types of user and admin activity in O365:
- User activity in ExO (Exchange mailbox audit logging)
- Admin activity in ExO (Exchange admin audit logging)
- User activity in SPO and OD4B
- Admin activity in SPO
- Admin activity in Azure AD (the directory service for O365)
- User and admin activity in Sway
Here's the process for searching the audit log in O365.
Step 1: Run an audit log search
Step 2: View the search results
Step 3: Filter the search results
Step 4: Export the search results to a file
But first U must turn on audit logging before U can start searching the O365 audit log. To turn it on, just click Start recording user and admin activity on the Audit log search page in the Security & Compliance Center. If U don't see this link, auditing has already been turned on for your organization.