Auditing in Office 365 (for Admins)

Enable auditing

  1. Sign into the Security & Compliance Center with your Microsoft 365 Admin account.

  2. Select Search & Investigation, and then select Audit log search.

  3. Select Start recording user and admin activity. If you don't see this link, auditing has already been turned on for your organization. A message alerts you that the audit log is being prepared.

  4. You can search the audit log for a variety of activities including uploads to OneDrive or SharePoint Online or user password resets.

  5. For more information about activities you can audit, see Search the audit log in the Microsoft 365 Security & Compliance Center.

  6. If you want to enable Mailbox Auditing, see the next tab: Enable mailbox auditing.

Enable mailbox auditing

  • To enable auditing for a single mailbox (in this example, belonging to Holly Sharp), use this PowerShell command: Set-Mailbox -Identity "Holly Sharp" -AuditEnabled $true.

  • To enable auditing for all Office 365 mailboxes in your organization, use this PowerShell command: Get-Mailbox -ResultSize Unlimited -Filter{RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled$true.

  • For more information about mailbox auditing, or to make specific choices about what mailbox actions get audited, see Enable mailbox auditing in Microsoft 365.

Review your audit log

  1. Sign in to the Security & Compliance Center with your Microsoft 365 Admin account.

  2. Select Search & Investigation, and then select Audit log search.

  3. Select the activities you want to audit. For example, mailbox activities such as one or more users signing into their mailbox or purging email.

  4. If you want to see synchronization activities for SharePoint Online or OneDrive, choose Synchronization activities. If you want to see when files are checked in, accessed, shared, or renamed in SharePoint Online and OneDrive, choose File and folder activities.

  5. You can only view events that happened after you turned on auditing in Office 365. Mailbox auditing is included in the Audit log search, but you must turn on mailbox auditing separately. For more information, see the previous tab: Enable mailbox auditing.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Any additional feedback? (Optional)

Thank you for your feedback!