Office 365 Email / SharePoint Audit Logs

[AndrewSeyffert]

Hi 

We have a client who is looking for reports on a specific user who is leaving the company. They'd like to find out if there are any emails this person sent with attachments to external parties.

Is there a way for me to search the audit logs for emails containing attachments? 

We then also ran an audit log on SharePoint files but can't seem to get it right. We need to be able to see if this person downloaded, deleted, or moved data from his machine offsite or from SharePoint. We'd like to be able to see on which device (laptop / SharePoint online).

I'm open to suggestions on doing this via the admin portal or on PowerShell.

Any advice would be appreciated.

Thanks,

[#2]

@AndrewSeyffert 

You can refer the following article to get the details of Audit Activities: Search the audit log in the Microsoft 365
For Mailbox I will recommend you put the mailbox on Litigation Hold if this guy is being investigated.

[#3]

@surajbudhani  thanks for the update. I'll investigate this. Yes, we are just waiting for feedback from the customer then might place the user in litigation hold as you suggested.