How to Export Office 365 Audit Logs
In this tutorial I will show you how to export security audit logs from your Office 365 Tenant. Before you can export audit logs from Office 365 you must enable audit logging in Office 365 Security & Compliance Center.
- Login to the Security & Compliance Center at https://protection.office.com
- Expand Security & investigation on the left menu and choose Audit Log search
- Chose a Start & End date and click Search
Note: You can further filter the log results by Activity such as Password Changed…, etc
- After the query runs click Export results | Download all results
- A csv export of the audit log will be presented for download
Thanks for following along! Leave a comment below if you have anything to add. I hope this tutorial for Office 365 Admins has helped you out, you may also be interested in my article…
2 Replies to “How to Export Office 365 Audit Logs”
I’ve downloaded a report for 2 months, IE a separate report for each. both are just over 60MB in size and both show exactly 50000 entries – that makes me think there’s some sort of limit on reporting / export as I can’t see how both months would have exactly the same number of events.
The audit logs download feature is a joke. There’s a 50,000 entries limit, not shown anywhere, and there’s no way to tell in advance if the selected timerange will export more lines than the limit.
The download speed is slow as hell, hovering between 0 and a max of 150k/s, with frequent pauses. Remember eMule? Except the final file is not necessarily porn in disguise.
File format: CSV, yes. but the last field is a JSON, and it’s where you will find _all_ the necessary information. Including the values from all the other CSV fields.
Oh, and last but not least, some lines are too long, and they get truncated. Repeat after me: incomplete audit logs. Brilliant!