Auditing in Office 365 (for Admins)


Enable auditing

  • Sign into theSecurity & Compliance Centerwith your Office 365 Admin account. 

  •  Select Search & Investigation, and then select Audit log search.

  • Select Start recording user and admin activity.If you don't see this link, auditing has already been turned on for your organization. A message alerts you that the audit log is being prepared.

  • You can search the audit log for a variety of activities including uploads to OneDrive or SharePoint Online or user password resets.

  • For more information about activities you can audit, seeSearch the audit log in the Office 365 Security & Compliance Center.

  • If you want to enable Mailbox Auditing,see the next tab: Enable mailbox auditing.

Enable mailbox auditing

  • To enable auditing for a single mailbox (in this example, belonging to Holly Sharp), use this PowerShell command: Set-Mailbox -Identity "Holly Sharp" -AuditEnabled $true.

  • To enable auditing for all Office 365 mailboxes in your organization, use this PowerShell command: Get-Mailbox -ResultSize Unlimited -Filter{RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled$true.

  • For more information about mailbox auditing, or to make specific choices about what mailbox actions get audited, seeEnable mailbox auditing in Office 365.

Review your audit log

  • Sign in to theSecurity & Compliance Centerwith your Office 365 Admin account.

  • Select Search & Investigation, and then select Audit log search.

  • Select the activities you want to audit. For example, mailbox activities such as one or more users signing into their mailbox or purging email. 

  • If you want to see synchronization activities for SharePoint Online or OneDrive, choose Synchronization activities. If you want to see when files are checked in, accessed, shared, or renamed in SharePoint Online and OneDrive, choose File and folder activities. 

  • You can only view events that happened after you turned on auditing in Office 365. Mailbox auditing is included in the Audit log search, but you must turn on mailbox auditing separately. For more information, see the previous tab: Enable mailbox auditing.