Unified Audit Log
Access the Microsoft 365 unified audit log for comprehensive activity tracking across all workloads. Search and filter audit events from Exchange, SharePoint, Entra ID, Teams, and more.
Overview
The Unified Audit Log provides a single consolidated view of activity events across all Microsoft 365 services. This is the authoritative source for compliance auditing, incident investigation, and change tracking across your managed tenants.
Log Columns
| Column | Description |
|---|---|
| Date/Time | When the activity occurred |
| User | User who performed the activity |
| Activity | Specific operation performed |
| Workload | Microsoft 365 service (Exchange, SharePoint, etc.) |
| Object | The item that was affected |
| Result | Success or Failure |
| IP Address | Source IP of the activity |
| Tenant | Which managed tenant the activity occurred in |
Supported Workloads
- Exchange Online — Mailbox access, admin operations, mail flow
- SharePoint Online — File access, sharing, site administration
- OneDrive for Business — File operations, sharing, sync events
- Microsoft Teams — Team/channel operations, meeting events
- Entra ID — User management, role changes, app registrations
- Compliance Center — eDiscovery, retention, DLP events
- Power Platform — Power Apps, Power Automate operations
Search Capabilities
Search the audit log using:
- Free text search — Search across all fields
- Activity type — Filter by specific operations
- User — Find all activities by a specific user
- Date range — Narrow results to a specific time window
- IP address — Find all activities from a specific source
Filters
- Date Range — Last 24 hours, 7 days, 30 days, 90 days, or custom
- Workload — Exchange, SharePoint, Teams, Entra ID, etc.
- Activity — Specific operation types
- User — Filter by user principal name
- Tenant — Filter by managed tenant
- Result — Success, Failure
Retention
Audit log retention depends on the license level:
- E3/Business Premium — 180 days
- E5 — 365 days (1 year)
- E5 with Advanced Audit — Up to 10 years
Compliance Use Cases
- Investigate unauthorized access to sensitive data
- Track administrative changes for change management
- Support eDiscovery and legal hold requests
- Monitor data exfiltration attempts
- Meet regulatory audit requirements
API Reference
GET /api/monitoring/audit/unified— Search unified audit logGET /api/monitoring/audit/unified/activities— List available activity typesPOST /api/monitoring/audit/unified/export— Export audit log data
Last updated on