20.2 Investigate Activities with Microsoft Purview Audit

Investigate Activities with Microsoft Purview Audit

Quick Answer: Search the unified audit log in the Microsoft Purview portal under Audit. You need the Audit Logs or View-Only Audit Logs role (Audit Manager or Audit Reader). Scope by UTC date (maximum 180 days per search), activities, record types, users, workloads, and locations. Jobs keep running after you close the browser, remain listed for 30 days, and can take up to 48 hours in large tenants. Script with Search-UnifiedAuditLog in Exchange Online PowerShell.

Purview Audit is the investigation surface for who did what, when, and from where across Microsoft 365. It records thousands of user and admin operations. It does not place a legal hold on mailbox or site content, and it is not Activity explorer's 30-day classification timeline. Use Audit when the question is an activity record: a sharing event, a mailbox access, a directory change, an eDiscovery cmdlet, or a Copilot interaction.

Permissions before you search

Assign least privilege in the Microsoft Purview portal:

• Audit Reader can search and export the audit log. It grants View-Only Audit Logs. It cannot enable or disable tenant auditing.
• Audit Manager can search, export, and manage tenant audit settings (including turning auditing on or off). It grants View-Only Audit Logs and Audit Logs.

You can add those roles to a custom Purview role group. Microsoft still requires the same Audit Logs / View-Only Audit Logs roles in the Exchange admin center to run audit cmdlets and to enable or disable auditing. Microsoft Graph Audit Search APIs need additional Graph permissions; do not assume Purview role-group membership is enough for Graph.

Do not grant Global Administrator just to run an audit search. Microsoft recommends the fewest privileges that still complete the investigation.

Administrative units restrict portal search. A restricted admin can search and export only user-generated logs in assigned units. An unrestricted admin can search all logs, including non-user and system accounts. Microsoft publishes a list of operations that restricted admins still cannot retrieve in the portal (including several Endpoint DLP file events and some Exchange cmdlets). Use an unrestricted admin or Search-UnifiedAuditLog when you must see those activities.

Confirm that ingestion is on

Audit log search is turned on by default for Microsoft 365 and Office 365 enterprise organizations. Verify the setting in Exchange Online PowerShell:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

True means ingestion is on. The same cmdlet exists in Security & Compliance PowerShell, but the UnifiedAuditLogIngestionEnabled property is always False there even when auditing is on. That mismatch is documented; it is a favorite false-negative.

Turn ingestion off or on with Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false or $true in Exchange Online PowerShell. If you turn auditing off, Purview search, Search-UnifiedAuditLog, the Office 365 Management Activity API, and Microsoft Sentinel lose audit data for the organization. Small-business and unmanaged trial tenants must turn auditing on manually before any search returns results.

Run a search in the Purview portal

1. Sign in to the Microsoft Purview portal.
2. Open the Audit solution card (or View all solutions > Audit from Core).
3. On the Search page, set criteria, then select Search.

Classic Search retired on 30 November 2023. New Search is the current UI: faster jobs, additional filters, saved searches, and a job dashboard.

Criteria that matter on the exam

• Date and time range (UTC). The last seven days are selected by default. The maximum range you can specify is 180 days. A longer range returns an error. If you use the full 180 days, set the start time to the current time so start is not after end. If auditing was enabled inside the last 180 days, the range cannot start before the enable date.
• Keyword Search. Matches indexed content in the audit common schema, not the full AuditData payload. Replace special characters with *. For example, search test*search*document rather than test_search_document.
• Activities - friendly names. Grouped names such as sharing and access request activities. You can select a group or individual activities.
• Activities - operations names. Exact operation names, comma-separated, with no typos (SPOIBIsEnabled,SPOIBIsDisabled). Incorrect names return zero results.
• Record types. Map to services. Information Protection examples include MIPLabel, MipAutoLabelExchangeItem, MipAutoLabelSharePointItem, and MipAutoLabelSharePointPolicyLocation.
• Users. Leave blank for all users and service accounts. For mailbox work, searching a mailbox owner does not return delegate activity (SendAs, SendOnBehalf) performed in that mailbox.
• File, folder, or site. Partial names or URLs; a * wildcard is supported at the end of a URL.
• Workloads and Admin Units further scope the query.
• Search name. Optional; otherwise the job is named from timestamp and criteria.

Microsoft does not guarantee a latency SLA. Core services (Exchange, SharePoint, OneDrive, and Teams) typically show records 60 to 90 minutes after the event. Other services can take longer. Outages outside the audit pipeline can delay records. Treat "it is not in the log yet" as a timing issue before you treat it as a product failure.

Power BI activities appear in the unified audit log only after you enable auditing in the Power BI admin portal.

Search job dashboard, export, and PowerShell

Microsoft publishes these operational limits for New Search. Memorize them as search-tool limits, not as audit-retention limits.

Jobs continue after you close the browser. Each admin can run up to 10 search jobs at once, with a limit of one unfiltered job. Completed jobs remain for 30 days. Deleting a job deletes the job definition and result set, not the underlying audit data. Copy this search clones criteria into a new query.

The dashboard shows search name, job status (Queued, In Progress, Completed), progress, search time, total results (an approximate count when a query returns more than 100,000 results), creation time, and who ran the search. The details view may show fewer items than the dashboard total because it removes duplicates.

Results include Date (UTC), IP address, User, Record type, Activity, Item, Admin Units, and Details. Open a row for the flyout. Export to CSV supports up to 50,000 rows for Audit (Standard) and up to 1,000,000 rows for Audit (Premium). Split the AuditData JSON column in Excel with Power Query so you can filter on nested properties.

Search-UnifiedAuditLog in Exchange Online PowerShell is the cmdlet behind the portal. Use it for automation. For continuous SIEM ingest, use the Office 365 Management Activity API rather than a looping PowerShell download. Premium tenants get higher API bandwidth (baseline 2,000 requests per minute, then scaled; E5 about twice non-E5).

Compromised-mailbox investigation with MailItemsAccessed

After you evict an attacker, identify compromised mailboxes and the access window, then search the MailItemsAccessed operation.

• Sync (Outlook for Windows or Mac downloading a folder): treat the whole folder as exposed. Filter AuditData for MailAccessType = Sync. Compare ClientIPAddress, ClientInfoString, and SessionId to attacker context.
• Bind (individual message access): records aggregate bind operations in a 2-minute window; InternetMessageId identifies messages; OperationCount shows how many binds were rolled up.

Duplicate bind records for the same message within an hour are filtered unless key properties change (IP, client, folder, logon type, access type, mailbox, user, or session). Sync operations are also filtered on a one-hour interval. MailItemsAccessed covers POP, IMAP, MAPI, EWS, Exchange ActiveSync, and REST. It is Audit (Standard) for E3/E5 mailboxes; Premium adds intelligent properties such as SensitivityLabel on those events.

Example unified-audit search shape:

Search-UnifiedAuditLog -StartDate 01/06/2026 -EndDate 01/20/2026 -UserIds user@contoso.com -Operations MailItemsAccessed -ResultSize 1000

Exam traps

• A 180-day search window is not the same as Premium retention. Premium-licensed Entra, Exchange, and SharePoint records can still exist for a year, but the portal search form rejects a date range longer than 180 days — run sequential 180-day searches.
• Keyword search does not scan every JSON property in AuditData.
• Operation names must match Microsoft's published names exactly.
• Closing the browser does not cancel a search job.
• Get-AdminAuditLogConfig in Security & Compliance PowerShell is the wrong place to verify ingestion.

Official resources

• Search the audit log — search criteria, job limits, export caps, admin units (updated 2026-06-19)
• Search the audit log to investigate common support issues — permissions and investigation patterns
• Use MailItemsAccessed to investigate compromised accounts — sync versus bind forensics (updated 2026-06-24)