Office 365 Auditing

[Tony Redmond]

An in-depth look at Office 365 auditing - how the data is generated, ingested, and used. All of which might be interesting if you suddenly find the urge to do a bit of auditing... https://www.petri.com/office-365-audit-data

[#2]

Didn't know Cogmotive released their product already. Definitely something to consider, given the price of ASM!

[#3]

It would have been good if the article explained that Unified Auditing was different than enabling Auditing on a site collection in SPO. Site collection auditing is still available and we ran into a situation where modifying permissions was not recorded in Unified Auditing but was in Site Collection auditing.

[#4]

I guess I could have gone to a level of detail for each of the workloads, but the point of the article is really to emphasize the "unified" nature of the auditing system Microsoft has built and is improving for Office 365. There's always likely to be edge cases where something doesn't quite work as you'd expect... but I am pretty confident (based on the progress in the last year) that the unified auditing system will cover these events in the future.