Monitor and Report Microsoft 365 Activity Using the Unified Audit Log
You want to know how your users use Microsoft 365. When you leverage the Unified Audit Log along with Entra ID and Power BI, you get clear details about what users and admins do. You can see things like email deletions, mailbox changes, and report downloads in your system. This setup lets you sort by date, role, or department, helping you analyze the data more closely. The tools that come with Microsoft 365 do not let you change much—they only show grouped data and keep it for a short time. By consolidating all your data in the Unified Audit Log, it becomes easier to monitor activity and generate better, more useful reports.
Key Takeaways
The Unified Audit Log keeps track of many user and admin actions in Microsoft 365. It helps you see file changes, email activity, permissions, and security events.
The Unified Audit Log makes security and compliance better. It shows who did something, when, and where. It also keeps data safe and controls who can see it.
You can look at audit data by hand with Microsoft Purview. You can also use PowerShell, APIs, and Azure Automation to search and export data automatically. This makes monitoring easier.
Power BI helps you look at audit data with simple reports and dashboards. You can see information about user roles, sign-ins, and Microsoft 365 Copilot use.
You should follow best practices like turning on all audit events, upgrading licenses, setting alerts, and protecting logs. This helps you monitor well and stay safe and compliant.
Unified Audit Log Overview
What It Tracks
It is important to know what happens in Microsoft 365. The Unified Audit Log keeps a record of what users and admins do. It covers many services and tracks lots of actions. You can see when people:
Look at, change, download, move, copy, or delete files or folders.
Share files and handle sharing invites.
Send, get, or delete emails.
Change mailbox permissions, log in, or update settings.
Upload, download, or change documents in SharePoint and OneDrive.
Make or remove teams, add or take away members, and post or delete messages in Teams.
Make or remove users, change roles, reset passwords, and manage licenses.
Handle groups, group members, and group settings.
Give or take away roles and change role settings.
Start or stop sync and change sync settings.
Manage security policies, search audit logs, and handle data governance.
Tip: The Unified Audit Log helps you watch thousands of actions. This makes it easier to find strange activity or changes.
Why It Matters
The Unified Audit Log helps keep your organization safe and follow rules. You can see what users and admins do. This helps with security checks and meeting laws. Microsoft keeps audit logs safe and controls who can see them. Only people with permission can view sensitive audit data. All access is watched closely.
Audit logs are managed in one place and collected by security rules.
Data is cleaned of personal info and kept safe.
Logs stay for at least one year to help with checks and rules.
Only certain people can see logs, and their access is tracked.
You can find security problems, rule breaks, and system misuse.
Logs help fix things after attacks or outages and help solve problems.
They give proof for legal and rule needs.
Microsoft Purview lets you set custom rules for keeping logs. You can keep audit records for up to 10 years if needed. This helps you follow rules in finance, healthcare, and government. The Unified Audit Log is your main tool for tracking, checking, and reporting actions. It gives you what you need to manage risk and follow rules.
Access and Search
Manual Access
You can get to the Unified Audit Log in Microsoft Purview. First, check if audit logging is turned on. It is usually on by default. Make sure you have a Microsoft 365 license and the right permissions. You need to be a Global Admin or Compliance Admin. Open your browser and go to
https://compliance.microsoft.com
. In the portal, look for the Audit section. Click on Audit Search. Use filters to make your search smaller. You can filter by activity, user, or date. Look at the results. You can export them to study more.
Note: Always check that audit logging is working before you search. You can check this in the portal or by using a PowerShell command.
PowerShell and API
PowerShell lets you control your searches better. Use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell. You can set things like StartDate, EndDate, RecordType, and ResultSize. If you search a lot, split the date range. This helps you not go over the 5,000 record limit. Export your results to a CSV file to look at them easily.
You can also use Microsoft Graph API for harder searches. Start by making a search with the beta endpoint:
POST https://graph.microsoft.com/beta/security/auditLog/queries
Check the status and get results with GET requests. Make sure you have the right permissions like AuditLogsQuery.Read.All.
Automation
You can set up regular exports of audit data with Azure Automation runbooks or scripts. Register an app in Microsoft Entra ID. Give it Office 365 Management API permissions. Keep client secrets safe in Azure Key Vault. Use scheduled flows to log in and export data. The Office 365 Management API puts audit events into blobs. This makes it easy to get new records as they show up. Automation helps you stay on top of compliance and security without doing it by hand.
Advanced Analytics with Power BI
Data Preparation
You must get your data ready before using Power BI for analytics. First, collect the Unified Audit Log data. Keep the raw data as it is. This helps you check old records or new fields later.
To make things easier, use a star schema design. This means you split your data into fact and dimension tables. You can pick where to change your data. Some groups use a data lake to manage layers. In this way, raw data goes in a "bronze" layer. Then, you process it into a "silver" layer. You keep finished data in a "gold" layer for reports. This lets you use many data models and helps report makers work on their own.
If you want it simple, change your data in Power BI with Power Query. This is good if you want one main data model and use incremental refresh. When you plan, think about where to keep your finished data. Choose your tools and name your tables well. Always set up security to keep private info safe.
Tip: Make your data better by splitting big tables into smaller ones. This lowers mistakes and makes dashboards work better.
This way of organizing helps you avoid errors. It also makes Power BI dashboards faster and more steady. When you update your data, changes show up everywhere. Your reports always have the newest info.
Entra ID Integration
You can learn more by adding Entra ID data to your audit log records. Entra ID has info about user roles, sign-ins, and access rules. When you bring this data into Power BI, you can see how users work in Microsoft 365 and what roles do certain things.
The Reports Reader role in Entra ID lets you see usage reports and dashboards. With this role, you can look at sign-in logs, audit logs, and activity reports. You do not get admin powers, but you can see all the data you need.
By joining Entra ID sign-in data with audit log events, you can track role changes, sign-ins, and access results. You can filter by multi-factor authentication or service principal sign-ins. This helps you find patterns in user access, role use, and security checks. Bringing both sets into Power BI lets you make detailed reports and charts. You can see which users reach private data and how they use their roles.
Copilot Usage Insights
Power BI helps you see how your group uses Microsoft 365 Copilot. You can measure how many people use it, how much they use it, and how it helps work. Here are some important things you can track:
You can also look at usage by department, role, or group. For example, you might want to know which sales leaders use Copilot most in Excel. You can see how chat use changes after training. Split users into groups like active, inactive, or non-users. Compare their actions to learn how people start using Copilot.
To find top Copilot users, use Power BI templates like the "Copilot business impact report." Load your usage data and group users by department or role. Set levels for usage, like low, medium, or high. Use filters to look at certain times or teams. This shows who gets the most from Copilot and where more training may help.
You can also study how much private info is used. Track how much sensitive data users mention during Copilot chats. Use filters and custom searches to look at certain apps or departments. This detail helps you lower risk and boost work.
Note: Power BI dashboards update every day, so you always see the newest Copilot use and engagement.
Overcoming Challenges
Limitations
When you use the Unified Audit Log, you might have problems. You need special permissions to search or export audit logs. Sometimes, you must give the Audit Logs role to your admin account. If your browser does not work, try a different one. This can fix access problems.
You cannot set up or change exports right in the Unified Audit Log. This makes it harder to automate and change things. Audit data comes as JSON, so you must change it before using it in reports. How long logs stay matters too. Microsoft 365 keeps logs for 180 days by default. Some services, like Azure AD, only keep logs for 30 days. You can make logs last longer with special licenses. These rules only start from when you set them up.
Note: Retention policies help you keep logs longer, but they do not work for old data. Make your policies early so you do not lose important records.
Best Practices
You can solve these problems by using good habits:
Upgrade to Audit (Premium) to keep logs longer and track more events.
Use PowerShell scripts like
Search-UnifiedAuditLogto collect and report data automatically.Connect your audit data to SIEM tools like Microsoft Sentinel for alerts and better threat checks.
Turn on all audit events so you do not miss anything important.
Check logs often for risky things, like admin changes or private data access.
Set up alerts for strange actions, like lots of downloads or failed logins.
Make sure your licenses and log rules fit your needs for following rules.
Compare audit data from different places to make sure it is correct.
Keep logs in the cloud so you can store them longer and grow as needed.
Protect your logs with encryption and strong rules for who can see them.
Doing these things makes your Unified Audit Log checks better and more trustworthy. It also helps you follow rules, stay safe, and keep improving.
To make Microsoft 365 monitoring work well, do these things:
Turn on audit logging for every service. Check that it works.
Look at Entra ID logs. Make sure you keep them long enough.
Connect logs to Power BI. This gives you live dashboards and smart reports.
Test your logging setup a lot. Review it to catch problems.
Keep your data safe. Use strong security and rules for saving data.
Power BI dashboards let you see how Copilot is used. You can find patterns and make good choices. Keep getting better at following rules. Use Microsoft’s audit reports, training lessons, and help from others.
FAQ
How do you enable the Unified Audit Log in Microsoft 365?
Go to the Microsoft Purview portal. Sign in with your admin account. Select “Audit” and check if logging is on. If not, click “Start recording user and admin activity.” You can now track actions across your organization.
What permissions do you need to access audit logs?
You need the Global Admin or Compliance Admin role. Assign these roles in Microsoft Entra ID. Only users with these roles can search, export, or view audit log data.
Can you automate audit log exports?
Yes, you can. Use PowerShell scripts or Azure Automation to schedule exports. Set up an app registration in Entra ID. Store secrets in Azure Key Vault. This keeps your process secure and hands-free.
How do you combine Entra ID data with audit logs in Power BI?
Export both data sets. Load them into Power BI. Use Power Query to join tables by user or role. Build reports that show user activity, access patterns, and Copilot usage.
What should you do if you see suspicious activity in the logs?
Review the details right away. Check which user or admin made the change. Alert your security team. Use Power BI to spot trends or repeat issues. Take action to protect your data.