Hi all,

If I say that you can now audit and get reports of modifications done in O365 like licenses modification ! That would be great, isn’t it ? This is now the case, thanks to the feature called “O365 Audit log report”.


By default, this feature is turned off, to enable it, follow this steps :

  1. Log on the O365 portal
  2. On the left pane, click on Compliance
  3. The Compliance Center should open
  4. Go to Reports and in the part Auditing, click on “Office 365 audit log report”
  5. The “Audit log search” page appear and you can now turn on the feature by clicking on the “Start recording user and admin activities” button.

This should take around 2 hours to be effective.

Now to search for any modification done on licenses :

  1. Enter a start date and an end date
  2. If you want to trigger any modification done by an admin, fill the “User” field
  3. Launch the Search
  4. And here is the result : LicenseAudit
  5. You can now use the filter on the item column in order to check modification done on a particular user.

This audit and report feature can also be used for Exchange Online and Sharepoint reporting like modification done a document hosted in a personal Onedrive storage.


The picture show modifications done on an excel file hosted in Onedrive, one modification has been done by an internal user and the other has been done by an external user.

You can audit the following solutions :

  • User activity in SharePoint Online and OneDrive for Business
  • User activity in Exchange Online (Exchange mailbox audit logging)
  • Admin activity in SharePoint Online
  • Admin activity in Azure Active Directory (the directory service for Office 365)
  • Admin activity in Exchange Online (Exchange admin audit logging)

Just to let you know :

  • You can search the Office 365 audit log for activities that were performed within the last 90 days.
  • It takes up to 15 minutes after an event occurs in SharePoint Online or OneDrive for Business for the corresponding audit log entry to be displayed. It takes up to 12 hours for events in Exchange Online and Azure Active Directory.

You can also perform your search using Powershell with the Search-UnifiedAuditLog cmdlet (https://technet.microsoft.com/library/mt238501(v=exchg.160).aspx)

You can get more information regarding this feature on this page https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Protection-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c?ui=en-US&rs=en-US&ad=US

En joy 🙂