'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Enable Microsoft 365 Auditing and Collect Teams Logs via API
Question details
The user wants to learn how to enable auditing in Microsoft 365 and use an API to programmatically collect Microsoft Teams audit logs, considering Office 365 E3 and E5 licensing differences.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Setting up enterprise compliance and audit logging for Microsoft Teams via API integration.
- Observed behavior
- The user needs a clear process to register the application, grant permissions, request tokens, and retrieve the audit logs successfully based on their subscription tier.
Ensure you have global administrator or compliance administrator permissions in your Microsoft 365 tenant, and access to the Microsoft Entra ID (formerly Azure AD) portal to register the application.
Setup Office 365 Management Activity API for Teams Logs
A complete workflow to turn on auditing, configure API access in Azure AD, and retrieve Teams audit logs.
Microsoft 365 provides the Office 365 Management Activity API to query audit events. Your licensing dictates bandwidth: E3 includes Audit (Standard) while E5 provides Audit (Premium) with higher-bandwidth access.
Navigate to the Microsoft Purview compliance portal, go to Audit, and click 'Start recording user and admin activity' to enable audit logging for your tenant.
Go to the Microsoft Entra ID (Azure AD) admin center, select App registrations, and create a new application for your API integration.
In your registered app's settings, assign the necessary Office 365 Management APIs permissions and click 'Grant admin consent' for your organization.
Configure your application code to request OAuth 2.0 access tokens from Azure AD using your tenant ID, client ID, and client secret.
Use the obtained access token to make HTTP GET requests to the Office 365 Management Activity API endpoints to subscribe to and query Microsoft Teams audit logs.
Discover WPS Office for Your Daily Productivity Needs
While Microsoft 365 handles complex enterprise compliance and API auditing, individual users and small businesses looking for a lightweight, highly compatible office suite can rely on WPS Office. It provides powerful Word, Excel, and PowerPoint alternatives without the heavy enterprise overhead.
Frequently Asked Questions
What is the difference between Audit Standard and Audit Premium?
Audit (Standard) is included with Office 365 E3 and retains logs for up to 180 days. Audit (Premium) requires an Office 365 E5 license, provides up to one year of retention by default, and allows high-bandwidth access to the Management Activity API.
Why am I not seeing Teams logs immediately after enabling auditing?
After you turn on auditing in the Microsoft Purview portal, it can take up to 24 hours for audit records to begin appearing in the search results and via the API.
Can I access the Office 365 Management Activity API without an Azure AD app?
No, you must register an application in Azure AD (Microsoft Entra ID) to obtain the necessary client credentials and access tokens required to authenticate API requests.
How do I grant tenant admin consent for the API application?
In the Azure portal, navigate to your App registration's 'API permissions' page, click on 'Add a permission', select Office 365 Management APIs, configure the required access levels, and then click the 'Grant admin consent for [Your Tenant]' button.
