Microsoft 365 / Search Purview audit logs for user and admin activity

To check what actions a user or admin has performed in Microsoft 365, use Microsoft Purview's Audit Log Search. Narrow down the target person, activity type, and occurrence period, then interpret the time, action, and target in the results. Audit logs are materials for investigating actual activities, not records that store all detailed actions of all services without limit.

What can you check with audit logs?

You can view user and admin activities across various Microsoft 365 services, such as file access and sharing, mailbox operations, and group or settings changes. The types of events collected, searchable points in time, and retention periods vary depending on the service and license. Check the current capabilities and conditions of your organization in Microsoft's Purview Audit getting-started guide.

If you want to investigate login successes and failures, Microsoft Entra sign-in logs provide more direct information than Purview audit searches. For mail delivery paths, use Exchange message trace. Choosing the appropriate log for your question is more important than expanding the search terms.

Preparing for audit searches

• Decide on one question to verify. For example: "Who changed the sharing settings of this file and when?"
• Obtain identifying information of the target user, file/site, or action.
• Check the occurrence time and time zone. The display time on the screen may differ from the log time zone.
• Verify audit search permissions. Lack of permissions does not mean there are no results; it may mean you cannot perform the search.

Check viewing permissions, retention period, and collection delays

Searching and exporting audit records requires the Audit Logs or View-Only Audit Logs role in Microsoft Purview. The Audit Reader role group includes search and export permissions; Audit Manager has broader capabilities. Administrative-unit assignments can restrict the records you can search. Clearing a search filter does not expand your authorized access. Being an Exchange or Teams administrator does not automatically give you access to every Purview audit record.

Audit (Standard) retains records for 180 days by default. For appropriately licensed Audit (Premium) users, Microsoft Entra ID, Exchange and SharePoint activities have one-year default retention; other activities and configured retention policies can have different conditions. Check the license of the user who performed the activity, the service and the applicable retention policy. One licensed administrator does not make everyone’s audit records eligible for one-year retention.

Recent activity may not be searchable immediately. Microsoft describes typical availability of 60–90 minutes for core services such as Exchange, SharePoint, OneDrive and Teams, but does not guarantee that interval. Collection latency is separate from the time a search job takes to run. A wider query cannot recover events that were never collected or are beyond retention. First check the organization’s audit collection status and whether the required activity is supported.

Searching in Purview

1. Open Audit → Search in the Microsoft Purview portal and set Date and time range (UTC), using Coordinated Universal Time. One search can span at most 180 days; this window limit is separate from your records’ retention period. Split a wider retained period into smaller search windows.
2. Filter by target user and type of activity. Start with key conditions rather than adding too many conditions from the beginning.

3. Run the search and open the results to check the operation time, user, target object, and details. If necessary, leave the event ID or record in the internal investigation document.
4. If there are no results, check the scope and time zone, search permissions, log collection delays, and whether the activity is subject to auditing. Do not conclude that no activity occurred just because there are no logs.

If Audit is absent from the portal home, select View all solutions → Audit. A search creates a job with status Queued, In Progress or Completed. It continues after you close the browser, so check existing jobs rather than launching duplicate searches.

Microsoft’s audit log search guide explains permissions, results and export. Exports use comma-separated values (CSV), a tabular data format, and can contain personal or security-sensitive information. Store them in the approved investigation location and do not attach raw exports to public posts.

Search example for investigating file sharing changes

Assume that you are investigating "who changed the sharing settings of this file this morning." Since the file owner and the person who made the change may be different, searching with only the owner at the stage when the actor is unknown could cause you to miss important results.

1. Obtain the site address where the file is located, the path to the file, and the time when the issue was discovered. Use the actual location to distinguish files with the same name.
2. Convert the incident time to UTC using the correct local offset, including daylight saving time where relevant. For example, Korea Standard Time (KST) is UTC+09:00: 10:00–12:00 KST is 01:00–03:00 UTC on the same date. Midnight can change the date: 00:30 KST on November 14 is 15:30 UTC on November 13.
3. Choose file or folder sharing activities under Activities - friendly names. If you use Activities - operations names, copy the exact name from Microsoft’s audit activity catalog; do not translate or guess operation names.
4. Specify the address/name range needed for file/folder/site conditions, and if the changer is unknown, leave the user condition blank for the search. Use identifiers in the search name to distinguish the incident.
5. Once the search task is complete, compare activities, timestamps, users and affected items together, and open the details of the related items. If there are no results due to overly narrow conditions, adjust the file range and activity conditions one by one.

Keyword Search searches indexed content in the common audit schema; it does not search every property in the detailed AuditData payload. Those details may be represented in JavaScript Object Notation (JSON), a structured data format. If a keyword query for a specific property finds nothing, check whether that field is indexed before drawing conclusions. Start with clear criteria such as the period, activity and actual file location.

Points to be careful about when interpreting results

Multiple related events may remain for one activity, or the timing of record reflection may differ by service. Automated accounts, apps, or delegated tasks may also appear with different user names. If it is an important incident, cross-check the detailed logs and configuration change records of the service with the user's explanation. Follow the organization's data processing standards so that audit results are not unnecessarily duplicated or retained even after the investigation purpose is completed.

For example, an audit record of sharing-link creation shows that a link was created at that time. It does not prove that an external recipient read the content. A file-access or download record also does not establish user intent or later external copying on its own. Distinguish the incident allegation from what the specific records support.

When there are no results or exports are needed

• Recent activity: Allow for collection latency and first check whether the existing search job has completed. To query again, use Copy this search to reuse the criteria and start a new search, adjusting the scope if needed.
• Period/Time Errors: Compare UTC and local time, check the date before and after midnight. Also, confirm the retention period.
• Target/Permission Errors: Verify whether the current organization and admin scope, and the actual actor and repository are correct. Do not look for SharePoint files in the location of an individual user’s OneDrive.
• Activity Condition Errors: Check the exact operation name, service support availability, and audit collection status. Reduce one condition at a time to find the cause.

Select Export from a completed search to analyze the results as CSV. The portal supports up to 50,000 exported rows for Audit (Standard) and 1,000,000 for Audit (Premium). Split a larger investigation into date or recipient ranges and check that your exports cover the intended results. Keep the original export unchanged and convert time zones in an analysis copy so you can compare your work with the original records.

Investigation records include the search conditions and time zone, search job ID and time, key events, and any ranges that have not yet been confirmed. For login failures, check in connection with Microsoft Entra sign-in investigation, and for mail delivery, check in connection with message trace, and do not conclude that an incident did not occur solely because a log is missing.