In this case, you should enter 'deleted file,' or 'file download' as the activity you want to check for. You can search the audit log based on time, activities, and users.įor example, if you consider an employee or guest user a data leak risk, you can check their activities through audit logs.Įnter and select the suspected user's name in the user field, choose a date range, and specify an activity to filter for. Click on the audit button to open the audit log page.

Go to the Microsoft 365 Admin Center and select the security tab in the left pane. So only trusted senior managers should have global admin access. That means you can review past user actions in your tenant if you've never done so.Īudit logging can be turned off by a global administrator. Office 365 audit logs show administrators what, who, where, when, and how of any event (user action) in their environment.īy default, audit logging is turned on for Office 365 and Microsoft 365 enterprise organizations. You can check user log-in patterns, communication, file view, edit, and share actions. The Office 365 audit log is your go-to tool for tracking user and administrative activity in your tenant.

Download o365 admin portal