Searching the audit log in Microsoft Purview: who did what, and when

"Who deleted that folder?", "Who made this account an admin?", "Who shared the board pack with an outside address?" The unified audit log answers these questions across Exchange, SharePoint, OneDrive, Teams and Microsoft Entra ID, as long as you search the right way. In this post I'll confirm auditing is on, explain how long records are kept, run a search in the Microsoft Purview portal, then do the same at scale with Search-UnifiedAuditLog.

Prerequisites#

• The Audit Logs or View-Only Audit Logs role in the Microsoft Purview portal for audit search. The audit cmdlets need the same roles in the Exchange admin center. View-Only Audit Logs is the least-privilege choice.
• Exchange Online PowerShell V3; see connecting with Exchange Online PowerShell V3.
• The incident time converted to UTC. Audit records and the portal's date picker both use UTC.

Step-by-step#

1. Confirm auditing is on#

Audit log search is on by default for enterprise tenants, but check before an investigation depends on it. Run this in Exchange Online PowerShell; in Security & Compliance PowerShell the property always reads False:

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

# Mailbox auditing on by default (False means it's on)
Get-OrganizationConfig | Format-List AuditDisabled

Good looks like UnifiedAuditLogIngestionEnabled : True and AuditDisabled : False. If ingestion is off, enable it with Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true; activity from before that moment isn't recorded.

2. Know how far back you can look#

Retention follows the licence of the user who performed the action, not the person searching:

If you need history beyond that, stream the log to a SIEM such as Microsoft Sentinel or collect it through the Office 365 Management Activity API now; you can't search back later.

3. Run a search job in the Purview portal#

In the Microsoft Purview portal, open Solutions › Audit and go to Search. Filter as tightly as you can:

• Date and time range (UTC): defaults to the last seven days; one search can span at most 180 days.
• Activities - operations names: exact operation names, comma-separated, such as FileDeleted,FolderDeleted. A typo returns nothing, so copy names from Microsoft's audit activities list. Activities - friendly names is the point-and-click alternative.
• Users: the accounts that performed the action. Leave it empty to include everyone, service accounts too.
• File, folder, or site: part of a name or URL; a trailing * works as a wildcard, for example https://contoso.sharepoint.com/sites/Finance*.
• Record types and Workloads: limit the search to SharePoint, Exchange, Teams and so on.
• Search name: use the ticket number so you can find the job again.

Searches run as background jobs, so you can close the browser. Each user can run up to 10 jobs at once, only one of them unfiltered, and completed jobs are kept for 30 days. Broad searches in large tenants can take up to 48 hours.

4. Read the results#

Open the job to see each event's date (UTC), IP address, user, record type, activity and item. Select an event for its details, use the filter pane to narrow further and select Export for a CSV, which includes the full AuditData JSON per record. Copy this search reruns the criteria with changes, such as a wider date range.

5. Search at scale with PowerShell#

Search-UnifiedAuditLog runs the same search in Exchange Online PowerShell. By default it returns only 100 records. With -SessionCommand ReturnLargeSet it pages through up to 50,000 unsorted results, up to 5,000 per call, as long as you reuse the same -SessionId:

$end     = (Get-Date).ToUniversalTime()
$start   = $end.AddDays(-7)
$session = [guid]::NewGuid().ToString()
$all     = [System.Collections.Generic.List[object]]::new()

do {
    $page = @(Search-UnifiedAuditLog -StartDate $start -EndDate $end `
        -Operations FileDeleted, FolderDeleted -SessionId $session `
        -SessionCommand ReturnLargeSet -ResultSize 5000)
    $all.AddRange($page)
} while ($page.Count -gt 0 -and $page[-1].ResultIndex -lt $page[-1].ResultCount)

$all | ForEach-Object {
    $d = $_.AuditData | ConvertFrom-Json
    [pscustomobject]@{
        TimeUtc   = $d.CreationTime
        User      = $d.UserId
        Operation = $d.Operation
        Item      = $d.ObjectId
        ClientIP  = $d.ClientIP
    }
} | Where-Object Item -like '*/sites/Finance/*' |
    Sort-Object TimeUtc |
    Export-Csv .\finance-deletions.csv -NoTypeInformation

Use the same -SessionCommand value for the whole session. For regular, high-volume exports, Microsoft recommends the Office 365 Management Activity API over scripts.

6. Know the operation names#

Many Microsoft Entra ID operation names, like the two above, end with a full stop; include it.

Verify#

Test the pipeline before you need it. In a test site, upload and delete a file, then search for FileDeleted with your account a couple of hours later. For core services such as Exchange, SharePoint, OneDrive and Teams, records are typically searchable 60 to 90 minutes after the event; other services can take longer, and Microsoft doesn't guarantee a time. Good looks like one record with your account, the file URL and your public IP address, in both the portal and the script output.

Tips & gotchas#

• No results isn't proof nothing happened. Recheck the UTC range, the exact operation name, the actor's retention and latency for recent events.
• Missing mailbox events. Even with mailbox auditing on by default, some mailbox events can be missing. Check Get-Mailbox user@contoso.com | Format-List AuditEnabled, DefaultAuditSet and whether the account has audit bypass (Get-MailboxAuditBypassAssociation).
• Administrative units limit what you see. A restricted admin sees only user activity within their units, not system or service-account events, so run sensitive investigations with an unrestricted account.
• Sign-ins belong in Entra. The sign-in logs hold far more detail; see Reading Microsoft Entra sign-in logs like an engineer. For rules, forwarding and mail access together, see Investigating a compromised Exchange Online mailbox.
• Power BI activity appears only after auditing is enabled in the Power BI admin portal.
• Very large searches can miss records when they time out; the cmdlet's -HighCompleteness switch favours completeness over speed, so expect it to run much longer.

References#

• Search the audit log
• Search-UnifiedAuditLog
• Use a PowerShell script to search the audit log