Microsoft 365 Audit Logs: A Complete Guide to Configuring & Using Office 365 Auditing

Microsoft 365 is far more than just email, document editing, or collaboration tools. It combines Exchange Online, SharePoint, OneDrive for Business, Microsoft Teams, Azure Active Directory, plus advanced intelligence, device management, and compliance capabilities. For organizations, this suite delivers powerful tools — but also greater responsibility.

One such responsibility is ensuring strong audit logging. Especially in enterprises with multiple tenants and thousands of users, knowing what’s happened — who did what, when, from where — is essential. Whether for security investigations, regulatory compliance, HR, or eDiscovery, audit logs are often indispensable. Yet many administrators either leave them off, misconfigure them, or under‑utilize them.

This guide shows how to configure the Office 365 (now Microsoft 365) audit log comprehensively, how to search it, how to retain and export the data, and best practices for using it to protect your environment.

Why Audit Logging Matters

• Security & Incident Investigation
  Track login attempts (successful and failed), IP addresses, geolocation; identify unusual access patterns; detect compromised accounts.
• Compliance & Regulatory Requirements
  Many industries require preserving audit logs for a certain period. Failure to maintain logs can lead to legal issues or penalties.
• Operational Visibility & Change Management
  Monitor who changed what in the admin centre, who created or removed users, modified mailbox settings, or altered permissions in SharePoint and OneDrive.
• Data Loss Prevention & eDiscovery
  Recover evidence of deleted files or messages, track forwarding rules, understand user interaction with sensitive documents or emails.

Key Concepts

• Unified Audit Log
  Microsoft 365 provides a unified audit logging feature, aggregating audit events from many services: Exchange, SharePoint, OneDrive, Teams, Azure AD, etc., so you have a central place to search and monitor.
• Retention Periods & Licensing
  The length of time logs are stored depends on your Microsoft 365 plan. Higher‑tier licenses typically allow longer retention and more features for audit data.
• Permissions
  Only administrators or users with specific roles (e.g. Compliance Admin, Security Admin, or View‑Only/Audit Logs roles) can enable, search, export, and manage audit logs.

Preparing to Enable Audit Logging

Before enabling audit logging, ensure you:

1. Have sufficient admin permissions
   The account must have roles that allow configuration of audit settings and viewing logs.
2. Confirm licensing & tenant settings
   Know your license (E3, E5, Business Premium, etc.) to understand retention limits. Also check whether there are any policy or regulatory mandates for data retention, or internal standards.
3. Decide on scope and objectives
   What do you need logs for? Security incident response, legal preservation, HR, operations? Which services are most important? Knowing that helps filter and structure audits smartly, so you’re not flooded with irrelevant data.

How to Enable Office 365 Audit Logging

Audit logging is not always enabled by default for all services in Microsoft 365. Follow this process to turn it on:

Using the Microsoft 365 Compliance / Security & Compliance Center

1. Sign in to the Microsoft 365 admin portal with an account that has appropriate permissions.
2. Navigate to the Security & Compliance Center (or Microsoft 365 Compliance under newer portals).
3. Go to Search & Investigation → Audit log search.
4. If audit logging isn’t already enabled, you’ll see an option/button labelled Turn on auditing. Click it to activate unified audit log ingestion.

Using PowerShell

If you prefer automation or need to script this across multiple tenants:

Connect‑ExchangeOnline ‑UserPrincipalName <your_admin_account>
Set‑AdminAuditLogConfig ‑UnifiedAuditLogIngestionEnabled $true

This command ensures that unified audit log ingestion is enabled for your tenant.

For Additional Services

Some services (for example, Power BI, Microsoft Teams, etc.) may require separate audit settings or enabling extra logging features. Be sure to check those service‑specific admin portals to ensure all necessary audit data is captured.

How to Search the Audit Log

Once auditing is enabled and you’ve waited for some time (often a few hours) for log ingestion, you can run searches to extract meaningful data.

Prerequisites

• Your user account must be assigned one of the audit-related roles (e.g. View‑Only Audit Logs, Audit Logs, Compliance Administrator, etc.).
• There may be a short propagation delay after enabling audit logging before the first events appear.

Procedure

1. Sign in to the Microsoft 365 Compliance / Security & Compliance portal.
2. Navigate to Search & Investigation → Audit log search.
3. Configure the search criteria: CriteriaWhat to SpecifyActivitiesPick the kinds of events you want to audit (e.g. file modifications, admin role changes, mailbox settings, login activity). There are many; choosing relevant ones helps focus your results.Date RangeSelect the period to search over. Default might be last 7 days. Depending on licensing, you might go back 90 days, one year, or more.UsersSpecify individual users, groups, or all users. If investigating a user, narrow down.Location / ObjectIf relevant, target specific files, SharePoint sites, folders, or mailboxes. Use wildcards or keywords where allowed to filter efficiently.
4. Apply any additional filters
   After initial results, you can filter by keyword, object name, IP address, client application, etc.
5. Dealing with large result sets
   • The UI often caps live results (for example at 5,000 items).
   • For large datasets, break searches into smaller time windows and run multiple queries.
   • Use CSV export to get raw data and combine in external tools if needed.

Exporting & Analyzing Audit Log Data

• Exporting Results
  Once you have a filtered set of results, export to CSV. This allows bulk download of records, often up to tens of thousands in total (depending on your license and tenant settings).
• Parsing AuditData
  In exported CSVs, there is often a column called AuditData (or similarly named) that contains JSON‑formatted details. Use tools like Excel’s Power Query, or equivalent JSON parsers, to split out the nested data into more readable columns (e.g. client IP, item name, user action).
• Storage & Long‑Term Retention
  Decide whether to store exported logs in a secure, versioned store. For compliance, many organizations keep logs beyond default retention periods, using external archival solutions if needed.

Best Practices & Common Pitfalls

Common pitfalls include: believing audit logging is already enabled; forgetting that some services require separate configurations; mis‑interpreting default retention limits; overlooking the need for external archiving; or failing to provide appropriate permissions.

Troubleshooting Tips

• If you enable audit logging but see no entries: wait several hours; ensure the services you want covered are supported by unified auditing; verify your permissions.
• If searches return the maximum number of entries (e.g. 5,000), refine date ranges or filter by user or activity to ensure you don’t miss relevant events.
• If JSON in AuditData is hard to parse: use Power Query in Excel or dedicated log tools that understand Microsoft 365 audit schema.
• If certain events aren’t appearing: check whether they are supported activities (Microsoft publishes lists of which services/events are included); check whether service‑specific auditing needs to be enabled.

Retention, Licensing & Compliance Considerations

• License‑based retention limits: The amount of time Microsoft retains audit logs depends heavily on your license. If you’re on a higher tier (for example E5) you generally get more retention than on lower tiers (e.g. E3). Be sure you know what your plan covers.
• Legal / Regulatory Requirements: Industries such as finance, healthcare, government often require retaining logs for specific periods (e.g. 1, 3, or more years). Make sure you meet those requirements.
• Data Privacy & Sovereignty: Log data can contain sensitive information (usernames, file paths, client IPs). Secure storage, access controls, encryption, and audit trail for who accessed logs themselves are important.

Example Scenarios

To illustrate what you can do with properly configured audit logs:

• Suspicious login investigation: Suppose a user reports strange activity. Audit logs reveal login from unexpected IP addresses, or inaccessible geographies, times outside working hours. You can correlate with device logs to identify compromise.
• Unauthorized document deletion: A user mistakenly deletes critical files in SharePoint. Audit logs show who deleted what, when, and from which device; you can then restore from version history or backup.
• Email forwarding detection: If someone sets up a forwarding rule (perhaps for an insider threat), audit logs show mailbox setting changes, forwarding rules creation, who performed them.
• Admin‑level changes monitoring: Someone elevates privileges, removes MFA, or changes password policy. Auditing ensures that you have recorded exactly who made the change and when.

Summary

Enabling and using Office 365 audit logs is foundational for secure, compliant, well‑governed Microsoft 365 environments. From set‑up through to searching, exporting, retention, and regular monitoring, every stage matters. The earlier you enable it, the better your visibility and the fewer gaps you’ll have when something goes wrong.

If you follow the steps and apply best practices above—enable audit logging right away, grant only necessary permissions, tailor what you audit, export & inspect data regularly, and align your log retention with compliance demands—you’ll have a robust audit capability that supports security, operations, and legal needs.