When something goes wrong in Microsoft 365, IT admins need answers fast. They need to know who accessed a mailbox, who deleted a file from SharePoint, or who changed admin rights. The primary source for this data is the Microsoft 365 Unified Audit Log. It captures activity across Exchange Online, SharePoint, OneDrive, Teams, Entra ID, and other Microsoft 365 services. Understanding how to search and analyse audit logs is an essential skill for troubleshooting, security investigations, compliance audits, and incident response.
Enable Audit Logging in Microsoft 365
Before searching for audit events, verify that audit logging is enabled in your tenant.
Important Note: Audit events are only collected after audit logging has been enabled. Events that occurred before audit logging was enabled cannot be recovered later.
To verify whether Unified Audit Logging is enabled, connect to Exchange Online PowerShell and run.
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled If status is False, enable the Microsoft 365 audit logging by running the following command.
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true After enabling auditing, Microsoft may require some time before events begin appearing in search results.
How Long Microsoft Audit Data is Retained
Before beginning an investigation, it is important to understand how long audit data is retained.
| License Type | Default Retention |
|---|---|
| Microsoft 365 Business | 90 days |
| Microsoft 365 E3 | 90 days |
| Microsoft 365 E5 | 1 year |
| Microsoft Purview Audit Premium | 1 year or longer |
| Custom Retention Policies | Up to 10 years |
If an event falls outside the retention window, it may no longer be available for investigation.
How to Search the Unified Audit Log in Microsoft Purview
Microsoft provides a graphical interface for searching audit records through the Purview portal. This approach is useful for occasional investigations and administrators who prefer a web-based interface. To search the unified audit log using Microsoft Purview portal, follow the below mentioned steps.
- Sign in to the Microsoft Purview portal.
- Expand Solutions in the left navigation pane.
- Select Audit.
- Open the Search tab.
- Specify a Start date and End date.
- Select one or more Activities if you want to filter for specific events.
- Optionally specify Users, Workloads, Files, Sites, or other available filters.
- Click Search. Review the returned audit records.
If you need to perform additional analysis, you can export the results for offline review.
Why the Microsoft Purview Portal Falls Short for Audit Logging
Microsoft provides audit search capabilities through the Purview compliance portal, and for occasional searches it works reasonably well. However, administrators often run into limitations when dealing with larger environments.
For example, searches must be performed manually, filtering options are limited, and exporting large datasets can become cumbersome. Integrating audit data into automation workflows, SIEM platforms, or scheduled reporting is also difficult through the web interface.
PowerShell provides far greater flexibility, making it the preferred option for many security and Microsoft 365 administrators.
How to Search the Microsoft 365 Unified Audit Log with PowerShell
PowerShell provides significantly more flexibility than the Purview portal and is often the preferred approach for security teams and Microsoft 365 administrators. Before running audit searches:
- Install the Exchange Online Management module.
- Connect to Exchange Online.
- Ensure the account has either the Audit Logs or View-Only Audit Logs role assigned.
Basic Cmdlets for Microsoft 365 Auditing
The primary cmdlet used for audit searches is Search-UnifiedAuditLog. Several parameters determine what data is returned.
| Parameter | Purpose | Example |
|---|---|---|
| -StartDate | Beginning of search window | (Get-Date).AddDays(-7) |
| -EndDate | End of search window | (Get-Date) |
| -Operations | Specific activity types | ‘MailItemsAccessed’ |
| -RecordType | Workload category | AzureActiveDirectory |
| -UserIds | Filter by user(s) | ‘user@contoso.com’ |
| -ResultSize | Records per page (max 5,000) | 5000 |
| -SessionId | Used for pagination | ‘AuditSession1’ |
| -SessionCommand | Pagination direction | ReturnNextPreviewPage |
A particularly important limitation is that a single search can only return up to 5,000 records at a time. Administrators investigating larger datasets must use pagination to retrieve additional results.
Example 1: Search Mailbox Access Activity
A common security investigation involves determining whether a mailbox has been accessed. The following example searches for mailbox access events during the past seven days.
Search-UnifiedAuditLog `
-StartDate (Get-Date).AddDays(-7) `
-EndDate (Get-Date) `
-Operations 'MailItemsAccessed' `
-UserIds 'user@contoso.com' This can help identify access patterns during a suspected account compromise investigation.
Example 2: Search SharePoint File Deletions
If users report missing files, audit logs can reveal who deleted them and when.
Search-UnifiedAuditLog `
-StartDate (Get-Date).AddDays(-7) `
-EndDate (Get-Date) `
-RecordType SharePoint `
-Operations FileDeleted This approach is often much faster than manually checking site activity through the SharePoint interface.
Example 3: Investigate Administrative Changes
Administrative actions are also recorded in the Unified Audit Log.
Search-UnifiedAuditLog `
-StartDate (Get-Date).AddDays(-30) `
-EndDate (Get-Date) `
-RecordType AzureActiveDirectory `
-Operations "Add member to role" This can help identify when privileged roles were assigned and by whom.
Parsing AuditData: Every result contains an AuditData field that is a raw JSON string, not a native object. Always convert it with $_.AuditData | ConvertFrom-Json. To explore fields for an unknown record type, run $parsed | ConvertTo-Json -Depth 5 on a sample record first.
Whether you’re investigating a security incident, tracking administrative changes, or meeting compliance requirements, the Microsoft 365 Unified Audit Log is an essential resource. By combining the ease of the Purview portal with the power and flexibility of PowerShell, administrators can audit activity more efficiently and gain deeper insight into what’s happening across their Microsoft 365 environment.
