What role does a user need to have in order to use the Audit log search?

%3CLINGO-SUB%20id%3D%22lingo-sub-1787698%22%20slang%3D%22en-US%22%3EWhat%20role%20does%20a%20user%20need%20to%20have%20in%20order%20to%20use%20the%20Audit%20log%20search%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1787698%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%26nbsp%3Brole%20does%20a%20user%20need%20to%20have%20in%20order%20to%20use%20the%20Audit%20log%20search%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESee%20attached..%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Capture.PNG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F227122iAB2C21D97A96FF5F%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Capture.PNG%22%20alt%3D%22Capture.PNG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%E2%80%83%3C%2FP%3E%3CP%3EThank%20you%20for%20your%20time%2C%3C%2FP%3E%3CP%3EOllie%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22audit%20log%20search.jpg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F227121i0828B3A3D7551B5A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22audit%20log%20search.jpg%22%20alt%3D%22audit%20log%20search.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%E2%80%83%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1787698%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAdmin%20center%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1788229%22%20slang%3D%22en-US%22%3ERe%3A%20What%20role%20does%20a%20user%20need%20to%20have%20in%20order%20to%20use%20the%20Audit%20log%20search%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1788229%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F71651%22%20target%3D%22_blank%22%3E%40Oliver%20McErlane%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EYou%20have%20to%20be%20assigned%20the%20View-Only%20Audit%20Logs%20or%20Audit%20Logs%20role%20in%20Exchange%20Online%20to%20search%20the%20audit%20log.%20By%20default%2C%20these%20roles%20are%20assigned%20to%20the%20Compliance%20Management%20and%20Organization%20Management%20role%20groups%20on%20the%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EPermissions%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3Bpage%20in%20the%20Exchange%20admin%20center.%20Note%20global%20administrators%20in%20Office%20365%20and%20Microsoft%20365%20are%20automatically%20added%20as%20members%20of%20the%20Organization%20Management%20role%20group%20in%20Exchange%20Online.%20To%20give%20a%20user%20the%20ability%20to%20search%20the%20audit%20log%20with%20the%20minimum%20level%20of%20privileges%2C%20you%20can%20create%20a%20custom%20role%20group%20in%20Exchange%20Online%2C%20add%20the%20View-Only%20Audit%20Logs%20or%20Audit%20Logs%20role%2C%20and%20then%20add%20the%20user%20as%20a%20member%20of%20the%20new%20role%20group.%20For%20more%20information%2C%20see%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fgo.microsoft.com%2Ffwlink%2Fp%2F%3FLinkID%3D730688%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3EManage%20role%20groups%20in%20Exchange%20Online%3C%2FA%3E%3CSPAN%3E.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Hi,

 

What role does a user need to have in order to use the Audit log search?

 

See attached..

Capture.PNG

Thank you for your time,

Ollie

audit log search.jpg

 

3 Replies
Highlighted

@Oliver McErlane 

You have to be assigned the View-Only Audit Logs or Audit Logs role in Exchange Online to search the audit log. By default, these roles are assigned to the Compliance Management and Organization Management role groups on the Permissions page in the Exchange admin center. Note global administrators in Office 365 and Microsoft 365 are automatically added as members of the Organization Management role group in Exchange Online. To give a user the ability to search the audit log with the minimum level of privileges, you can create a custom role group in Exchange Online, add the View-Only Audit Logs or Audit Logs role, and then add the user as a member of the new role group. For more information, see Manage role groups in Exchange Online.

Highlighted

@Ruud Gijsbers Is this the same for SharePoint? I don't want to give them permissions to search Exchange?

Highlighted

@Oliver McErlane as far as I know, you can't differentiate between the different services. If you have permission to search the admin audit log, you can search all services.