Searching the Audit Log

Administrators use the Microsoft 365 Compliance Center to search the Audit Log for events of interest. Administrators select which events (“activities”) may be of interest (in this case, files accessed) to the user involved, and a time window. Results of the search are shown at the bottom. The results can be exported in CSV format to Excel or another tool; however, the export function limits the number of entries to 50,000 per search. Administrators must have the View-Only Audit Logs role or Audit Logs role enabled in order to search the log.

Become a DOM member or log in to read the full report