Skip to Content
ReportsMonitoringAudit ActivityAdmin Activity Log

Admin Activity Log

Track all administrative actions performed across your Microsoft 365 tenants. Monitor who made changes, what was changed, and when changes occurred.

Overview

The Admin Activity Log records all administrative operations performed in your managed Microsoft 365 environments. This includes changes to users, groups, policies, configurations, and settings made through any admin interface or API.

Log Columns

ColumnDescription
Date/TimeWhen the activity occurred
AdminThe administrator who performed the action
ActivityDescription of the administrative action
TargetThe object that was modified (user, group, policy, etc.)
TenantWhich tenant the activity occurred in
ResultSuccess or Failure
IP AddressIP address from which the action was performed
ClientApplication or portal used to perform the action

Activity Categories

  • User Management — Create, modify, delete, enable/disable users
  • Group Management — Group creation, membership changes, property updates
  • Policy Changes — Compliance policies, security configurations, conditional access
  • License Management — License assignments, removals, and changes
  • Role Assignments — Admin role grants and revocations
  • Exchange Admin — Mailbox, transport rule, and mail flow changes
  • SharePoint Admin — Site, sharing, and storage changes
  • Security Settings — MFA, authentication methods, and security policy changes

Filters

  • Date Range — Last 24 hours, 7 days, 30 days, 90 days, or custom
  • Admin — Filter by specific administrator
  • Activity Type — User, Group, Policy, License, etc.
  • Tenant — Filter by managed tenant
  • Result — Success, Failure

Compliance and Auditing

The admin activity log supports compliance requirements:

  • Maintain a complete audit trail of all administrative changes
  • Export logs for external compliance review
  • Set up alerts for sensitive administrative actions
  • Meet regulatory requirements for change tracking (SOC 2, ISO 27001, etc.)

Graph API Data Sources

  • GET /auditLogs/directoryAudits

API Reference

  • GET /api/monitoring/audit/admin-activity — Get admin activity log
  • GET /api/monitoring/audit/admin-activity/summary — Get activity summary
  • POST /api/monitoring/audit/admin-activity/export — Export log data
Last updated on
Alert PoliciesService Health