Forum Discussion
Solved
SharePoint Online site collection Audit Logs vs Office 365 Unified Audit Logs
Is Office 365 Unified Audit logs just a duplication of SharePoint online site collection audit logs ? If yes is it okay to turn off SharePoint Oniline site collection audit logs ? If no what ...
The thing about the Office 365 audit logs is that any entries ingested from a workload, like SharePoint, are normalized based on a known schema. This means that the information captured in the audit log from SharePoint is the same as you'd get from SharePoint, but it's in a common format that makes it easy to match SPO data with other workloads.
St William I think the below mentioned logs are captured within unified logs without turning on SharePoint audit Logs, can TonyRedmond and jcgonzalezmartin please confirm.
Teodora Badiu
Microsoft
MicrosoftSt William, i could find some of the events you mentioned, here:
https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance . Did you find this from your testing or is there any documentation underlining the fact that some events are captured in the O365 logs ONLY if SPO audit logging is also enabled?
Thanks!
The Unified crap line method might be in place, but the need for auditing at the site collection level is not going away. Any audit service should be on the bottom of the processing stack for load balancing, but still needs to be there for site collection admins to use. Also, these could be timed and auto-deleted so not creating a massive load of logs.
More broke stuff (as far as collection admin is concerned) - not cool.
