Use a screen reader to search for, export, and review audit logs in the Microsoft 365 compliance center

This article is for people who use a screen reader program such as Windows Narrator, JAWS, or NVDA with Microsoft 365 products. This article is part of the Microsoft 365 screen reader support content set where you can find more accessibility information on our apps. For general help, visit Microsoft Support.

Use Microsoft 365 compliance center with your keyboard and a screen reader to search for, export, and review mailbox audit logs. We have tested it with Narrator in Microsoft Edge and JAWS in Chrome, but it might work with other screen readers and browsers as long as they follow common accessibility standards and techniques.

The Exchange mailbox auditing logs information to the mailbox audit log whenever a user other than the owner accesses the mailbox. Each log entry includes information about who accessed the mailbox and the actions performed.

1. In Microsoft 365 compliance center, press the Tab key until you hear with JAWS: "Menu, collapse navigation." With Narrator, you hear: "Collapse navigation, menu item, expanded."

2. Press the Down arrow key until you hear "Audit," and press Enter.

3. The Audit search opens. Press the Tab key until you hear with JAWS: "Leaving menus, toolbar, tab, Search." With Narrator, you hear: "Search tab item, one of three." Press Enter. You can now define the search criteria for the audit logs you want to export.

4. To define the start date, press the Tab key until you hear "Start date," and press Enter. A date picker opens. Use the arrow keys to find the start date you want, and press Enter.

5. To define the start time, press the Tab key until you hear "Start time," and press Enter. Press the Down arrow key until you hear the start time you want, and press Enter.

6. To define the end date, press the Tab key until you hear "End date," and press Enter. A date picker opens. Use the arrow keys to find the end date you want, and press Enter.

7. To define the end time, press the Tab key until you hear "End time," and press Enter. Press the Down arrow key until you hear the end time you want, and press Enter.

8. To select the activities you want to include in the audit log, press the Tab key until you hear "Activities, show results for all activities," and press Enter. Then do one of the following:

   1. To search for activities, type your search words, for example, mailbox. The list of search results is updated as you type. With JAWS, switch to focus navigation. To browse the search results, press the Down or Up arrow key until you hear the activity you want, and press Spacebar to select it. Repeat to each activity you want to select.

   2. To browse the entire list of all available activities, press the Down or Up arrow key until you hear the activity you want, and press Spacebar to select it. Repeat to each activity you want to select.

9. When you're done selecting the items, press Esc.

10. To select one or more users whose activities you want to include in the audit log, press the Tab key until you hear "Users," and then do one of the following:

    1. To open and browse a list of suggested users, press Spacebar. The focus moves to the first user on the list. Press the Down arrow key to move down the list. To select a user, press Enter. Repeat for all additional users you want to add to the log.

    2. To search for a user, start typing their username. The list of search results is updated as you type. To navigate the search results, press the Down arrow key until you hear the right username, and then press Enter to select it. Repeat for all additional users you want to add to the log.

11. If you want to define a folder, file, or site to include in the audit log, press the Tab key until you hear "File, folders, or site," and type the URL of the resource you want.

12. To start the search, press the Tab key until you hear "Search, button," and press Enter. When the search has been completed, you hear "List loaded," followed by the number of matching items.

13. To export all search results, press the Tab key until you hear "Export, menu item," and press Enter. You hear: "Download all results." Press Enter.

14. The search results are downloaded to your computer as a .csv file. You hear: "Download complete." To access the file, press the Tab key until you hear "Downloads bar," followed by the audit log details. Press the Right arrow key until you hear "Open file," and press Enter. The file opens in Excel.

    Tip: You can find the log file also in the Downloads folder of your PC.

Each log entry includes information about non-owners of the mailbox who accessed the mailbox and the actions performed. For a list of the activities that can be logged by mailbox audit logging, refer to Exchange mailbox activities.