Forum Discussion
Solved
MDATP audit logs
Where can we see audit logs of what users in the securitycenter portal are doing? More specifically, if we select a W10 machine and go to 'Action Center', we see, per action, a summary of the last co...
mclaes , you can achieve this programmatically using the List MachineActions API (action history for all machines): https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection
Another place is the audit node under https://security.microsoft.com/auditlogsearch
Under "Activities" start typing "defender" and you'll see all supported audit activities for MDE
it still not in the same level as with Intune or AAD audit logs (btw: you might find there some of the activities you are looking for).