Microsoft 365 Auditing and Activity Reports

What is Microsoft 365 Auditing?

Microsoft 365 auditing provides a centralized record of user and administrator activities across Exchange Online, SharePoint Online, OneDrive for Business, Azure Active Directory, Microsoft Teams, Power Apps, and other workloads. It is the foundation for security investigations, compliance reporting, and forensic analysis. The audit log records events such as file accesses, mailbox logins, user creation, role changes, and policy modifications. Without auditing, an organization has no visibility into who did what and when — a critical gap for any security-conscious enterprise.

How the Unified Audit Log Works

Every auditable action in Microsoft 365 generates an audit record that is sent to the Unified Audit Log (UAL). The UAL is stored in Azure Data Explorer (formerly Azure Data Lake) and is retained for a configurable period depending on the license: 90 days for E3/G3, 365 days for E5/G5, and up to 10 years with an add-on license (Microsoft 365 Extra Retention). The log contains the following fields: CreationTime, UserIds, Operation, ObjectId, Workload, ClientIP, and more. You can access the UAL through the Microsoft 365 Defender portal (under Audits), the Microsoft Purview compliance portal, or via PowerShell using the Search-UnifiedAuditLog cmdlet.

Auditing vs. Activity Reports

Activity reports are pre-built dashboards that summarize usage and adoption metrics, such as how many users activated Office, how many Teams meetings were held, or which SharePoint sites are most active. They are found in the Microsoft 365 admin center under Reports > Usage. Auditing, on the other hand, records every action at a granular level and is used for security and compliance investigations. The exam tests both, but auditing is more heavily emphasized.

Enabling Auditing

By default, auditing is turned on for all Microsoft 365 tenants created after January 2019. For older tenants, an admin must enable it manually in the Microsoft 365 Defender portal or via PowerShell. To enable auditing via PowerShell:

Searching the Audit Log

You can search the audit log using the Microsoft 365 Defender portal (Security > Audit) or the Microsoft Purview compliance portal. You specify a date range (up to 90 days at a time), select activities (or leave blank for all), and optionally filter by users, files, or IP addresses. The search returns up to 50,000 entries per query; for more, you must use PowerShell or export to CSV. The search results show each event with the date, user, activity, item, and details. You can click on an event to see the full audit record in JSON format, including the AuditData field with all properties.

Audit Log Retention

Retention is based on the user's license, not the admin's license. For example, if a user has an E3 license, their audit records are kept for 90 days. If a user has an E5 license, records are kept for 365 days. This is a common exam trap: candidates often think retention is based on the tenant license or the admin's license, but it is per-user. The retention period starts from the date the event was recorded. After the retention period expires, the audit record is permanently deleted and cannot be recovered. To extend retention beyond 365 days, you need the Audit Log Retention for Office 365 add-on (available as part of E5 Compliance or as a standalone SKU).

Audit Log Search Queries

When you run an audit log search, you can filter by: - Activities: A list of predefined activities grouped by workload (e.g., File accessed, Mailbox login, User changed password) - Users: One or more user names - Start/End date: Up to a 90-day window - File, folder, or site: URL or path - IP address: Client IP - Workload: Exchange, SharePoint, Azure AD, etc. - Result: Success, Failure, or PartiallySucceeded - Record Type: ExchangeItem, SharePointFileOperation, AzureActiveDirectory, etc.

Exporting Audit Logs

You can export up to 50,000 records from the portal as a CSV file. For larger exports, use the Search-UnifiedAuditLog cmdlet in PowerShell with the -ResultSize parameter (up to 5000 per page) and loop through pages. Example:

Alert Policies

Alert policies allow you to automatically notify designated recipients when specific activities occur. For example, you can create an alert that triggers when a user is added to a privileged role, when a mailbox forwarding rule is created, or when a large number of file deletions occur in SharePoint. Alerts can be configured in the Microsoft 365 Defender portal under Policies & rules > Alert policy. Each alert policy has: - Name and description - Category: Threat management, Data loss prevention, Information governance, etc. - Severity: Low, Medium, High - Detection frequency: How often the system checks for matching events (default 15 minutes) - Trigger threshold: For example, 10 occurrences in 5 minutes - Recipients: Email addresses that receive the alert notification - Limit: Whether to stop sending alerts after a certain number of notifications (e.g., 10 per hour)

Activity Reports

Activity reports are found in the Microsoft 365 admin center under Reports > Usage. They provide at-a-glance summaries for: - Microsoft 365 Groups: Group creation, usage, and activity - Email activity: Send/receive counts, mailbox storage, and spam reports - Microsoft Teams: Active users, meetings, messages, and channel usage - OneDrive: Active users, storage, and file sync - SharePoint: Site usage, storage, and file activity - Yammer: User activity and engagement - Forms: Form creation and response counts - Office activations: Devices and platforms where Office is activated - Microsoft 365 Apps usage: Active users per app

Azure AD Audit Logs

Azure AD audit logs record activities related to user management, group management, application registrations, and directory changes. They are separate from the Unified Audit Log but can be accessed via the Azure AD portal or the Microsoft 365 Defender portal. Azure AD audit logs have a retention of 30 days for Azure AD Free, 30 days for Azure AD P1, and 30 days for Azure AD P2 (but you can export to Azure Storage or Log Analytics for longer retention). The exam often tests the difference: Azure AD audit logs are for directory-level events, while the Unified Audit Log covers workload-level events.

Exchange Mailbox Audit Logging

Exchange Online has its own mailbox audit log that records who accessed a mailbox, when, and what actions they performed (e.g., HardDelete, SoftDelete, Move, Create). By default, mailbox audit logging is enabled for all users. You can search mailbox audit logs using the Exchange admin center or PowerShell. This is separate from the Unified Audit Log but can be searched alongside it.

SharePoint and OneDrive Auditing

SharePoint and OneDrive auditing captures events like file view, download, upload, delete, rename, and permission changes. These events are sent to the Unified Audit Log. You can also use SharePoint's built-in audit log reports (Site Collection Audit Settings) for on-premises-style auditing, but for online, the Unified Audit Log is the primary source.

Compliance Boundaries

When searching the audit log, you can only see events that your organization owns. If you are a global admin, you can see all events. But if you have delegated admin permissions (e.g., a partner), you see only the events for the tenants you manage. This is important for multi-tenant environments.

Performance and Scale

The Unified Audit Log can handle billions of events per day across Microsoft's global infrastructure. When you run a search, the query is executed against a distributed data store and results are returned within minutes. For very large tenants, you may need to narrow your date range or use more specific filters to avoid timeouts. The 50,000 result limit is per query; if you need more, you must paginate with PowerShell or use the API.

Auditing and eDiscovery

Audit logs are a key data source for eDiscovery cases. When you create a Content Search in the Microsoft Purview compliance portal, you can search across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams. The audit log itself is not searched by Content Search; but you can use the audit log to determine who accessed or modified content that is relevant to a case.

Summary of Key Differences

Exam Tips

Scenario 1: Insider Data Theft Investigation

A healthcare organization suspects an employee is exfiltrating patient records from SharePoint. The security team uses the Unified Audit Log to search for all file download events by that user in the past 90 days. They filter by the user's email, the specific SharePoint site URL, and the activity 'File Downloaded'. The search returns 200 events. They export to CSV and analyze the timestamps, file names, and IP addresses. They find downloads occurring at odd hours from a non-corporate IP. The evidence is used to terminate the employee and report to legal. Without auditing, the investigation would be impossible.

Scenario 2: Compliance Reporting for GDPR

A financial services company must prove to regulators that only authorized personnel accessed sensitive customer data. They configure audit log retention for 1 year using E5 licenses for all employees who handle PII. They run monthly audit log searches for 'MailboxLogin' and 'FileAccessed' events for those users. They export the results and store them in a secured Azure Storage account for long-term retention. They also set up alert policies to notify the compliance officer if any admin accesses a customer mailbox outside business hours. This automated monitoring reduces manual effort and ensures compliance.

Scenario 3: Malicious Admin Activity Detection

A global admin's account is compromised. The attacker creates a new user, adds them to the Global Administrator role, and deletes several SharePoint sites. The security team discovers the breach when users report missing data. They search the audit log for the compromised admin's activities in the past 24 hours. They see the exact times of user creation, role assignment, and site deletion. They also find that the attacker accessed the audit log itself and deleted some records (though deletion of audit records is not possible — this is a trap). They use the audit log to trace the attacker's IP and identify all affected resources. They then revoke the compromised account, restore the sites from recycle bin, and implement conditional access policies to prevent future breaches.

Common Pitfalls