Microsoft 365 audit logging — how to check user and admin actions

Microsoft 365 audit logging records user and administrator activity in the unified audit log (accessible via Microsoft Purview) so you can trace sign-ins, mailbox access and file changes in one place; use it to investigate incidents, support ICO reporting and review suspicious actions within a single portal.

What Microsoft 365 audit logging captures and where to look

Microsoft 365 audit logging centralises records of many platform actions so you can see who did what, when and from where. Commonly captured events include sign-ins, mailbox operations, file access in SharePoint and OneDrive, Teams changes and admin configuration updates. The main interface is the unified audit log inside Microsoft Purview (previously the Security & Compliance centre), which provides a searchable timeline and export options.

Understand the limits: not every tiny event is logged by default and some specialised services keep separate traces. Exports go to CSV or can be forwarded to a SIEM for long-term storage and correlation. Typical small-business workflows are:

• Search the unified audit log for a user, activity or date range.
• Filter by workload (Exchange, SharePoint, Azure AD) to narrow results.
• Export hits for evidence or deeper analysis.

Make a simple mapping of key actions you care about (for example: external file shares, mailbox forwarding rules, global admin role changes) and check those event types first when investigating. That reduces noise and helps you spot real issues quickly.

How to use audit logs for investigations, compliance and reporting

When an incident happens, audit logs are the business record you use to answer three practical questions: who, what and when. Start with an initial search for the user or object, filter by time window and export matched events. Use the activity details to build a timeline you can attach to an incident report or hand to advisors. A tight habit is to save exports in a secure folder and record the search parameters so evidence is reproducible.

Practical steps small IT teams can follow:

1. Confirm the unified audit log is enabled for your tenant.
2. Search by username, IP address or activity type for the incident window.
3. Export results, redact unrelated personal data, and store the file with your incident notes.

If the incident could be a personal data breach, use audit evidence to decide whether you must notify the ICO and affected individuals. For configuration, long-term retention and automated alerting you may want to forward logs to your SIEM or to an archive. If you need hands-on help verifying settings or designing exports, consider Microsoft 365 support for business to reduce your response time and get expert validation.

Common gaps UK SMEs hit and quick fixes to close them

Many small organisations assume audit logging is fully on and discover too late it isn’t capturing the events they need. Common gaps are: audit not enabled, retention too short for your compliance needs, overly broad admin access and no export or alerting process. Each gap has a practical, low-cost fix.

• Audit not enabled: Turn on the unified audit log in Purview; verify by running a known test action and searching for it.
• Retention mismatch: Decide whether the default retention matches your regulatory needs; if not, plan exports or archive to a SIEM.
• Too many admins: Restrict audit-search and export rights to a named small team; use role separation.
• No alerting: Create simple activity alerts for high-risk actions (global admin role changes, external sharing enabled) and route them to a monitored mailbox or ticket queue.

For fast wins, schedule these checks: confirm audit is enabled, run a test search, restrict role assignments and set one or two high-priority alerts. These steps typically take a few hours for a small IT team and dramatically improve investigative confidence.

When to ask for help

If your team cannot locate key events, needs longer retention, or you suspect a breach that may require ICO notification, get external help. A short engagement can validate settings, export evidence correctly and configure alerts so future incidents are found faster — saving time, protecting reputation and reducing potential regulatory exposure.

Related reading

• our microsoft 365 support for business guide
• Microsoft 365 security audit service: what UK SMEs need to know
• Microsoft 365 quarantine management — control quarantined mail and reduce false positives
• Cost of Microsoft 365 managed services — a practical guide for UK businesses
• How to set up Microsoft 365 tenant: a sensible path for UK SMEs

FAQ

How quickly must I tell the ICO if audit logs show a personal data breach?

You must notify the ICO within 72 hours of becoming aware of a reportable breach unless it’s unlikely to result in risk to people; see the ICO’s guidance for details and exceptions. ICO guidance

Can I keep Microsoft 365 audit logs for longer than the default?

Yes. Extended retention usually requires an appropriate licence or an add-on and often means exporting logs to a SIEM or archive; plan the export and storage policy before you need old data.

Who in my business should have access to search and export audit logs?

Limit full search and export rights to a small, named security or compliance team; many organisations assign these rights to no more than 2–3 people to reduce risk while keeping cover for holidays.

How long does it take to get useful search results from the audit log?

Simple searches usually return results within seconds, though complex queries and large exports can take a few minutes; if events don’t appear, confirm audit was enabled before the incident window.