Microsoft has historically been quite protective over the accessibility of their detailed audit logs in Microsoft Purview, especially for audit logs that are notably useful for admins attempting to conduct thorough investigations.
Now, Microsoft is expanding the availability of the following 4 audit logs to standard users, where they were previously only accessible to Microsoft Purview premium users:
- MailItemsAccessed
- Send
- SearchQueryInitiatedExchange
- SearchQueryInitiatedSharePoint
Standard Microsoft Purview users will be able to access these items while they are in preview, beginning June 2024 and the rollout of the logs in GA will start in September 2024.
To access the Microsoft Purview Audit log, follow the below steps:
- Login to https://compliance.microsoft.com/
- Under Solutions, select Audit.
- Use the New Search tab to conduct a search.
You can use the Activities – friendly names tab to conduct a meaningful search for the activities you want to investigate. For example, to find Send (currently premium, soon to be free) activities, search for Sent message.
Information from the Microsoft 365 Roadmap
Microsoft 365 Roadmap | Microsoft 365 Feature ID: 182259
- Feature ID: 182259
- Added to roadmap: 10/18/2023
- Product(s): Microsoft Purview compliance portal
- Cloud instance(s): Worldwide (Standard Multi-Tenant), GCC High, DoD, GCC
- Platform(s): Web
- Release phase(s): General Availability, Preview
