How to Export Office 365 Audit Logs

How to Export Office 365 Audit Logs

In this tutorial I will show you how to export security audit logs from your Office 365 Tenant. Before you can export audit logs from Office 365 you must enable audit logging in Office 365 Security & Compliance Center.

  1. Login to the Security & Compliance Center at https://protection.office.com
  2. Expand Security & investigation on the left menu and choose Audit Log search
  3. Chose a Start & End date and click Search
    Note: You can further filter the log results by Activity such as Password Changed…, etc

  4. After the query runs click Export results | Download all results

  5. A csv export of the audit log will be presented for download

Thanks for following along! Leave a comment below if you have anything to add. I hope this tutorial for Office 365 Admins has helped you out, you may also be interested in my article…

How to create Alert Policies in Office 365 

2 Replies to “How to Export Office 365 Audit Logs”

  1. I’ve downloaded a report for 2 months, IE a separate report for each. both are just over 60MB in size and both show exactly 50000 entries – that makes me think there’s some sort of limit on reporting / export as I can’t see how both months would have exactly the same number of events.

  2. The audit logs download feature is a joke. There’s a 50,000 entries limit, not shown anywhere, and there’s no way to tell in advance if the selected timerange will export more lines than the limit.
    The download speed is slow as hell, hovering between 0 and a max of 150k/s, with frequent pauses. Remember eMule? Except the final file is not necessarily porn in disguise.
    File format: CSV, yes. but the last field is a JSON, and it’s where you will find _all_ the necessary information. Including the values from all the other CSV fields.
    Oh, and last but not least, some lines are too long, and they get truncated. Repeat after me: incomplete audit logs. Brilliant!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Ads Blocker Image Powered by Code Help Pro

🙏🙏A Humble Request to Disable AdBlock 🙏🙏

You can close this message & continue reading but...
❤️❤️❤️ Please consider visiting one of my sponsors first ❤️❤️❤️

DigitalOcean 🚀

Sign up and get a $200, 60-day credit to try DO.
Spend $25 after your credit expires and I will also get $25 in credit!
DigitalOcean Referral Badge

Pictory 🤖

Create amazing videos using Pictorys AI powered software.
Its FREE to create your first 3 video projects
pictory


Hi Reader, I noticed that you are using an ad blocker while visiting my website. While I completely understand that excessive ads can hinder your browsing experience, ad revenue helps pay for the cost associated with operating this website.

jcutrer.com is a labor of love, created with the primary aim to provide you with quality content, free of cost. It’s a space where I share information, ideas, and insights that I hope have a meaningful impact. However, maintaining and updating this platform incurs substantial costs.

Sincerely,
Jonathan