Audit Microsoft 365 User Activity with Purview

How to Audit User Activity with Microsoft Purview

Audit User Activity is vital for maintaining security and ensuring compliance within your organization. It helps you identify suspicious behavior and protect sensitive information. Microsoft Purview offers robust features that simplify the process of tracking user activity. With this tool, you can monitor thousands of audit events, gaining insights into user behavior and compliance status.

Utilizing audit logs not only enhances your governance strategies but also strengthens your threat detection capabilities. For instance, the Premium Audit option allows for custom retention policies and intelligent insights, which are essential for organizations aiming to bolster their security measures over time.

Key Takeaways

• Audit User Activity is crucial for security and compliance in organizations.
• Microsoft Purview simplifies tracking user activity with robust audit features.
• Assign specific permissions and roles to manage access to audit logs effectively.
• Enable audit logging to monitor user actions and identify suspicious behavior.
• Use filtering options in the audit log search to focus on relevant user activities.
• Regularly schedule audits to maintain visibility into user actions and detect risks.
• Integrate Microsoft Purview with SIEM systems for enhanced threat detection.
• Ensure privacy and compliance by applying strong controls during audit log collection.

8 Surprising Facts About Microsoft Purview Audit Log

1. Audit user activity with Microsoft Purview isn’t limited to basic sign-ins—its unified audit log records detailed user and admin actions across Exchange, SharePoint, OneDrive, Teams, Azure AD and other Microsoft services in one place.
2. The audit entries are rich JSON records that include contextual fields (client IP, user agent, item IDs, operation details), making automated analysis and threat hunting far more precise than simple timestamped events.
3. Microsoft Purview Audit Log captures non-owner mailbox access and delegated activities, so “hidden” mailbox reads by service accounts or delegates often appear in the audit trail.
4. You can stream Purview audit data to external systems (Log Analytics, Event Hubs, SIEM) via diagnostic settings or APIs—making audit user activity with Microsoft Purview usable in large-scale security monitoring pipelines.
5. Audit data can reveal governance changes and policy edits (role assignments, DLP rule changes, retention policy updates), so it’s a prime source for detecting malicious or accidental configuration drift.
6. Purview audit integrates with alerts and automation: you can trigger alert policies or Logic Apps based on specific audit events to escalate suspicious user activity automatically.
7. The platform supports long-term investigations: exported audit logs preserve raw details needed for eDiscovery, insider-risk investigations, and compliance proofs beyond standard portal search results.
8. Because audit records include granular file and sharing events (preview, download, external share, link creation), auditing user activity with Microsoft Purview can surface subtle data-exfiltration patterns that traditional network logs often miss.

Auditing Prerequisites

Permissions and Roles

To effectively audit user activity in Microsoft Purview, you need specific permissions and roles. These roles determine your access to audit features and the ability to manage audit logs. The following table outlines the essential roles:

Role/Permission	Description
Audit Reader	Allows viewing of audit logs.
Audit Administrator	Allows management of audit settings and logs.

Role-based access controls in Microsoft Purview enhance the visibility and management of audit logs. They enable precise delegation of permissions, which improves efficiency in accessing audit logs and supports targeted investigations. This targeted access allows you to respond quickly to incidents and conduct thorough investigations.

Enabling Audit Logging

Enabling audit logging is a crucial first step in your auditing process. Here are the necessary steps to activate the Unified Audit Log in Microsoft Purview:

1. Audit (Standard) is enabled by default for organizations with the appropriate subscription, so no manual activation is needed initially.
2. Assign the necessary permissions to users to access the audit log search tool and related cmdlets.
3. Ensure users have the correct Microsoft Purview Audit (Premium) license if advanced features are required.
4. Use the Audit log search tool in the Microsoft Purview portal to search and review audit records.
5. Alternatively, use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell to query audit events or automate searches.
6. Verify the auditing status for your organization to confirm audit logging is active.
7. If auditing is not enabled, follow the steps to turn on auditing.
8. Configure auditing for each Power Platform production environment as part of setup.
9. Assign appropriate permissions within Microsoft Purview to manage audit logs.
10. Manage audit log retention policies to control how long audit data is kept.
11. Use the provided Microsoft Purview articles and tools to get started and maintain auditing solutions effectively.

When setting up audit logging, organizations may face challenges. For instance, turning audit logs into actionable insights can be complex. Without the right tools or specialized PowerShell expertise, admins often spend more time managing data than acting on it.

By following these prerequisites, you can ensure that your organization is well-prepared to audit user activity effectively.

Access Audit Logs

Navigating the Purview Portal

To access audit logs in Microsoft Purview, you first need to navigate the portal effectively. Start by logging into the Microsoft Purview portal. Once inside, follow these steps:

1. Select Audit from the left-hand navigation pane.
2. Click on Search to access the audit log search feature.
3. Ensure you have the necessary roles, such as Audit Logs or View-Only Audit Logs, to view the audit data.

After you complete these steps, you will be ready to search for specific audit events. Remember, it may take up to 60 minutes for audit data to become available after enabling audit logging.

Filtering and Exporting Logs

Once you access the audit logs, you can refine your search to find specific user activities. Microsoft Purview offers several filtering options to help you narrow down the results:

1. Date and time range (UTC): Set a date and time range to display events within that period, with a maximum of 180 days.
2. Keyword Search: Enter keywords or phrases to search within the audit log.
3. Admin Units: Scope your search to specific administrative units.
4. Activities - friendly names: Choose from friendly names for audited activities.
5. Activities - operation names: Input exact operation names for more precise searches.
6. Record types: Select record types for audited activities.

These filters allow you to focus on relevant data, making it easier to identify trends or suspicious activities.

After filtering the logs, you may want to export the results for further analysis or compliance reporting. Microsoft Purview supports exporting audit logs in a comma-separated value (.csv) format. This format includes a column named AuditData, which contains detailed event information formatted as a JSON object. You can use tools like Excel's Power Query Editor to transform this JSON data into multiple columns, enabling effective sorting, filtering, and analysis of audit events.

By following these steps, you can efficiently access and analyze audit logs, enhancing your ability to monitor user activity and maintain compliance.

Audit User Activity Analysis

Understanding Audit Logs

Audit logs serve as a vital resource for monitoring user activities within Microsoft Purview. They provide detailed records of actions taken by users and administrators. You can interpret these logs to identify unusual or suspicious activities that may indicate security threats. For example, if a user accesses sensitive files outside of normal hours, this could raise a red flag.

Audit logs also assist in incident investigations. They detail what occurred, when it happened, and who was involved. This information is crucial for understanding the context of any potential security incidents. Additionally, these logs support compliance monitoring by documenting user and admin activities required by regulatory standards.

Here are some common user activities recorded in Microsoft Purview audit logs:

Category	Common User Activities Recorded
Viva Goals	Creating, deleting, updating dashboards; managing organizations, teams, and users; user sign-ins
SharePoint and OneDrive	Accessing, modifying, downloading, and restoring files and folders; detecting malware
Microsoft Entra Risk Detection	Detection of compromised sign-ins and users indicating risk events
Application Administration	Managing service principals and credentials

Key Metrics and Insights

You can derive several key metrics and insights from Microsoft Purview audit logs for compliance monitoring. These metrics help you maintain oversight of user activities and ensure adherence to policies. Here are some important aspects to consider:

• Centralized tracking of user and administrator activities across Microsoft 365 services enables comprehensive compliance monitoring.
• Long-term retention of audit logs, ranging from 180 days up to 10 years, meets regulatory requirements such as HIPAA and PCI DSS.
• Intelligent forensic insights include detailed logging of user behavior, which is critical for investigations and insider threat detection.
• Powerful search and filtering capabilities allow you to narrow down logs by user, activity type, service, and date range, facilitating quick investigations.

Using audit log data effectively supports investigations and incident response. For instance, if a Data Loss Prevention (DLP) policy flags an attempted sharing of sensitive information, audit logs provide a detailed trail of the user's activities. This helps you understand the context of the incident and identify any unauthorized actions.

By analyzing these logs, you can enhance your organization's security posture and ensure compliance with internal policies and external regulations.

Audit Best Practices

Scheduling Audits

Scheduling regular audits helps you stay ahead of security risks and compliance issues. By reviewing audit logs frequently, you gain clear visibility into user activities, especially those of privileged accounts. These accounts have elevated permissions, so monitoring them closely reduces the chance of unauthorized access or misuse.

Set up alert policies for critical events, such as when someone grants admin privileges or deletes many files at once. These alerts notify you immediately, allowing quick responses to potential threats. Periodic reviews of audit logs also help you spot unusual patterns or anomalies before they escalate.

Integrating Microsoft Purview with your Security Information and Event Management (SIEM) system enhances your audit process. SIEM tools collect and analyze security data from multiple sources, including audit logs. This integration lets you automate alerts and correlate events, improving your ability to detect and respond to risks faster.

Privacy and Compliance

Maintaining privacy during audit log collection and analysis is essential. Microsoft Purview supports this by applying strong privacy controls and compliance features. It captures audit logs across Microsoft 365 services while protecting user identities through pseudonymization and role-based access controls.

You can customize what data to collect and store using granular collection policies. These policies let you specify sensitive information types and AI interaction details, ensuring you gather only what you need. Retention policies help you manage how long audit data stays in your system, preventing unnecessary data storage.

Microsoft Purview also includes solutions like Communication Compliance and Insider Risk Management. These tools detect risky or inappropriate activities while safeguarding user privacy. Data Lifecycle Management automates retention and deletion of audit data according to regulatory requirements, helping you meet compliance standards.

The Audit (Premium) option offers extended retention and logs high-value events with licensing controls. This feature ensures you maintain privacy and compliance even at scale, making it easier to meet strict regulatory demands.

Automation Option	Description
Set up alert policies for critical events	Define rules in the Compliance portal to trigger alerts for specific audit events like privilege grants or mass deletions.
Use tools to analyze the logs	Export logs for deeper analysis with Excel or Power BI, and integrate with security monitoring via Microsoft Graph APIs.

By following these best practices, you strengthen your ability to audit user activity effectively while protecting privacy and meeting compliance requirements.

Troubleshooting

Access Issues

You may encounter access issues when trying to view audit logs in Microsoft Purview. Here are some steps to help you resolve these problems:

• Verify Auditing Status: Use PowerShell commands to check if auditing is enabled. If it is not, enable it via PowerShell.
• Check Permissions: Ensure you have the necessary roles assigned to access audit logs. Roles like Audit Reader or Audit Administrator are essential.
• Refresh and Clear Cache: Sometimes, refreshing the portal or clearing your browser cache can resolve display issues.
• Service Health Check: Look at the Azure status page to see if there are any outages affecting your access.
• Review Activity Logs: Check activity logs for insights into any errors you might be facing.

If you follow these steps and still experience issues, consider reaching out to Microsoft support for further assistance.

Log Completeness

Missing or incomplete audit log entries can hinder your ability to monitor user activity effectively. Several factors may contribute to this issue:

• Misconfiguration: Ensure that your diagnostic settings are correctly configured to capture all relevant logs.
• Connectivity Issues: Intermittent connectivity can lead to gaps in log entries.
• Retention Policies: Review your retention policies to confirm they align with your logging needs.
• Log Filtering: Check your log analytics filters to avoid unintentionally excluding important data.
• Ingestion Delays: Sometimes, delays in log ingestion can cause temporary gaps in the data.

To address these issues, follow these steps:

1. Verify your diagnostic settings to ensure all relevant logs are captured.
2. Check your log analytics filters to avoid unintentional exclusions.
3. Review pipeline execution logs for patterns in missing records.
4. Monitor Azure Service Health for any ongoing issues that might affect log completeness.

If you continue to experience problems with missing logs, consult the Microsoft Purview troubleshooting library for guidance. You can also search the audit log for common support issues using the command:

Search-UnifiedAuditLog -StartDate <date> -EndDate <date> -FreeText (Get-Mailbox <mailbox identity>).ExchangeGuid

By following these troubleshooting steps, you can enhance your experience with Microsoft Purview and ensure that you have access to complete and accurate audit logs.

---

To audit user activity effectively, follow these essential steps:

1. Verify your organization’s subscription and billing.
2. Assign permissions to search the audit log.
3. Enable SearchQueryInitiated events.
4. Set up Audit (Premium) for users.
5. Configure audit retention policies.
6. Search for audited events regularly.

Regular audits provide critical insights into threats, improve visibility into user actions, and help maintain proper permissions. Microsoft Purview captures activities across core services, giving you a centralized view for investigations and compliance.

Apply best practices like data classification, protection policies, and continuous monitoring to maximize your audit data’s value and strengthen your security posture.

Audit User Activity with Microsoft Purview - Checklist

• Define audit objectives and scope: identify systems, user groups, data types, and compliance requirements.
• Confirm licensing and permissions: ensure Microsoft Purview (and Microsoft Purview Audit or Microsoft Purview Audit Logs) licensing and assign required admin roles (Global Admin, Compliance Admin, Audit Logs Reader).
• Enable unified audit log: verify Microsoft 365 unified audit logging is enabled for the tenant.
• Configure Microsoft Purview audit settings: enable auditing features relevant to user activity (e.g., Exchange, SharePoint, OneDrive, Teams, Azure AD activities).
• Map critical activities to audit events: list specific user actions to capture (sign-ins, file access, file changes, sharing, mailbox access, admin actions).
• Set retention policies: configure audit log retention periods to meet legal and organizational requirements.
• Verify data ingestion and indexing: confirm audit events are being collected, ingested to Purview, and indexed for search.
• Configure alerts and alerts policies: create alert rules for high-risk or anomalous user activities (unusual sign-ins, mass downloads, privilege escalation).
• Enable advanced hunting and analytics: set up queries, workbooks, and Power BI dashboards for ongoing monitoring and trend analysis.
• Establish search and investigation procedures: document how to search audit logs, filter by user, date, activity type, and export findings.
• Integrate with SIEM/SOC: forward audit logs to SIEM (e.g., Azure Sentinel) or SOC workflows for correlation and incident response.
• Automate incident response playbooks: create automated actions for common audit-detected incidents (suspend account, revoke sessions, require MFA reset).
• Protect audit data integrity: restrict access to audit logs, enable immutable storage where available, and log access to audit logs themselves.
• Document roles and responsibilities: assign owners for monitoring, investigation, reporting, and retention management.
• Schedule regular reviews and audits: perform periodic reviews of audit settings, retention, alerts, and completeness of captured events.
• Train staff and stakeholders: provide training on using Microsoft Purview audit tools, searching logs, interpreting events, and escalation procedures.
• Perform test investigations: run simulated incidents to validate detection, alerting, and investigation workflows.
• Maintain compliance reporting: generate and archive reports required for regulatory compliance and internal governance.
• Update checklist and configuration: review and adjust audit scope, rules, and retention as environment and threats evolve.

FAQ

What is Microsoft Purview?

Microsoft Purview is a comprehensive solution for auditing user activity within Microsoft 365. It helps organizations track user actions, ensuring security and compliance.

How do I enable audit logging?

To enable audit logging, access the Microsoft Purview portal, assign necessary permissions, and activate the Unified Audit Log. Follow the setup steps outlined in the portal.

What types of activities can I audit?

You can audit various activities, including file access, permission changes, mailbox activity, and administrative actions across Microsoft 365 services.

How long are audit logs retained?

Audit logs can be retained for different periods, ranging from 180 days to up to 10 years, depending on your organization's settings and licensing.

Can I export audit logs?

Yes, you can export audit logs in CSV format. This format allows for easy analysis and reporting using tools like Excel.

What should I do if I can't access audit logs?

If you encounter access issues, verify your permissions, check the auditing status, and refresh the portal. If problems persist, contact Microsoft support.

How can I improve my auditing process?

To enhance your auditing process, schedule regular audits, monitor privileged accounts, and integrate Microsoft Purview with your SIEM system for better threat detection.

What are the benefits of using audit logs?

Audit logs provide insights into user behavior, help detect security threats, and support compliance with regulatory requirements. They are essential for effective governance.

What is Microsoft Purview audit and how does it relate to Microsoft 365 audit?

Microsoft Purview audit is the auditing solution within the Microsoft Purview compliance portal that records user and admin activity across Microsoft 365 services, including Office 365, SharePoint Online, Exchange Online and Microsoft Teams. It centralizes auditing in Microsoft and provides the Microsoft 365 audit and 365 audit log experience with added capabilities when you have the appropriate Microsoft 365 license such as Microsoft 365 E5 or Microsoft 365 E5 Compliance.

How do I start recording user and admin activity using the Microsoft Purview portal?

To start recording user and admin activity, go to the Microsoft Purview compliance portal, enable audit if it is not already enabled, and configure policies to retain audit records. For many tenants auditing is enabled by default, but you should verify in the Microsoft 365 admin center and the Purview audit solution settings. Recording covers activity performed by user or admin accounts across services like Exchange Online and SharePoint Online and is visible via audit search and the 365 management activity API.

How can I search the audit log or audit events for specific activities?

Use the audit search functionality in the Microsoft Purview compliance portal or call the Office 365 Management Activity API/365 management activity API to search for specific activities. You can search for audited activities and filter by user, activity type, date range, or service (for example SharePoint Online or Microsoft Teams) to find specific audited activities or search for specific activities performed by a user or admin.

What is the retention period for audit and how do retention policies to retain audit records work?

Default audit log retention policy varies by Microsoft 365 subscription; basic auditing retention is limited while Microsoft 365 E5 provides extended retention. You can configure log retention policies to retain audit records for a specified retention period for audit by using the Microsoft Purview audit solution and retention policies to retain audit data according to organizational or regulatory requirements. Policies to retain audit records are managed in the compliance portal.

Can I use the Office 365 Management Activity API to export audit data and what is the 365 management activity api reference?

Yes, the Office 365 Management Activity API (also referred to as the 365 management activity API) allows you to programmatically pull audit events recorded by Microsoft Purview. Refer to the 365 management activity api reference on Microsoft Learn for endpoints, schema and examples to export and process audit search results and to integrate with external auditing solutions in Microsoft.

Which specific activities are audited and how do I search for specific activities in Microsoft Purview?

Audited activities include file access and sharing in SharePoint Online, mailbox access in Exchange Online, sign-ins and directory changes in Microsoft Entra ID, and collaboration actions in Microsoft Teams. Use audit search and the Office 365 management activity API to search for specific activities or activity performed by a user. The portal and API let you filter for specific audited activities and activity types.

What auditing capabilities are available for Microsoft Entra ID and how does Microsoft Entra audit integrate?

Microsoft Entra ID emits audit logs for identity and directory operations which are integrated into the Microsoft Purview audit solution. You can search Microsoft Entra audit events alongside other Microsoft 365 audit events in the Purview compliance portal. Integration helps you correlate performs an audited activity across identity and service activity for investigations.

Do I need a Microsoft 365 license to access advanced auditing features like long-term retain audit log or Microsoft 365 E5 compliance?

Advanced auditing features such as extended retain audit log periods and enhanced audit capabilities are typically available with Microsoft 365 E5 or Microsoft 365 E5 Compliance. Basic auditing and the default audit log retention policy may be available with other Microsoft 365 subscriptions, but requirements like retain audit for longer retention periods usually require higher-tier Microsoft 365 licenses.

How do auditing solutions in Microsoft Purview work with Microsoft Defender for Cloud Apps and Microsoft Purview Information Protection?

Auditing solutions in Microsoft Purview capture activity data that can be correlated with alerts and signals from Microsoft Defender for Cloud Apps and Microsoft Purview Information Protection. This combined telemetry helps you investigate incidents by reviewing audit events, search for audited activities, and apply retention or retention policies to retain relevant audit data, enabling end-to-end compliance and security workflows.