Using the Microsoft 365 audit log to find out what happened

What gets recorded

The unified audit log, found in the Microsoft Purview portal, gathers activity from Exchange, SharePoint, OneDrive, Teams, Entra ID and other services. It covers file access, edits, shares and deletions, mailbox actions such as creating inbox rules or sending as another user, admin changes to users and settings, and sign-in related events. Each record shows the user, the action, the time and the item affected.

Separate from the audit log, the Entra admin centre keeps sign-in logs showing every sign-in attempt, where it came from, which app was used and whether multi-factor was completed. Together they let you trace an incident: an unusual sign-in from overseas, followed by a new inbox rule forwarding mail, followed by a change to someone's bank details in an invoice email.

Make sure it is switched on

Auditing is enabled by default for most newer tenants, but older tenants, or ones where settings were changed, may have it off. In the Purview portal, open Audit; if auditing is not turned on, the page offers to start recording. It is worth checking now, because if it is off when something goes wrong there will be nothing to investigate.

Mailbox auditing is also on by default in Exchange Online, recording actions by mailbox owners, delegates and admins. Records are kept for a limited period that depends on your licence; standard audit retention is measured in months, while premium auditing in higher plans keeps them longer. Check the current retention for your plan, and export anything important you want to keep beyond that window.

Searching after a suspected compromise

If you suspect someone's account was taken over, start with the Entra sign-in logs for that user. Look for sign-ins from unexpected countries, unfamiliar devices or apps, or times when the person was asleep. Then search the audit log for that user over the same period, focusing on inbox rule creation, mail forwarding changes, mass file downloads and sharing link creation.

Common signs include a new rule that moves messages containing words like invoice or payment to an obscure folder, mail sent to many contacts in a short time, or a new app given permission to read mail. Document what you find with screenshots and exported results. If personal information may have been accessed, you will need these records to assess whether it is a notifiable privacy breach under the Privacy Act 2020.

Everyday questions it can answer

The audit log is not only for security incidents. It can answer who deleted the client folder last Tuesday, who changed the shared calendar, who shared the pricing spreadsheet with an outside email address and when a file was last opened. Searching by file name or user and narrowing the date range usually finds the answer within a few minutes.

Search results can be filtered by activity type and exported to a spreadsheet for sorting. For recurring questions, such as weekly reports of external sharing, alert policies or scheduled reports can surface the information without anyone needing to run searches by hand. Keep in mind that access to the audit log itself should be restricted to the people who need it.

Alerts built on the log

Microsoft 365 can raise alerts from audit events, such as when someone creates a forwarding rule, when many files are deleted in a short time or when an admin role is assigned. Several useful alert policies are on by default, but they only help if notifications go to someone who reads them. Check who receives them and send them to a monitored mailbox.

For small businesses, a handful of alerts is enough: new forwarding rules, mass deletion, admin role changes, sign-ins to emergency access accounts and unusual volumes of file downloads. More than that tends to create noise that gets ignored. If an alert keeps firing for normal activity, tune it rather than switching it off.

Keep enough history to be useful

Many incidents are discovered weeks after they began, often when a supplier asks why an invoice was paid to the wrong account. If the audit retention period has passed, the evidence is gone. Businesses with higher risk may prefer a licence with longer audit retention or a security monitoring service that stores logs separately.

At a minimum, know your current retention period, check the log is recording, and export relevant results promptly whenever you investigate something. Practise one search now, such as finding who last edited a well-known file, so the steps are familiar on the day you need them under pressure, possibly with a worried director looking over your shoulder.