How to Export SharePoint Online and Microsoft 365 Audit Logs
Question details
The user needs to learn how to search for Advanced Audit logs in Microsoft 365 and export the results to another system or file for reporting.
- Product
- Microsoft 365 / SharePoint Online
- Device & OS
- not provided
- Scenario
- Generating compliance reports by searching the system's audit logs and saving the output locally.
- Observed behavior
- Requires a method to export search results from the Microsoft Purview compliance portal into a downloadable CSV format.
Ensure you have the necessary administrator permissions in Microsoft 365, such as being assigned the Audit Logs or View-Only Audit Logs role, and verify that audit logging is turned on for your organization.
Export Audit Logs via Microsoft Purview Compliance Portal
Use the built-in audit log search tool in the Microsoft Purview compliance portal to find and download audit records as a CSV file.
The Microsoft Purview compliance portal provides a centralized interface for searching user and administrator activities across Microsoft 365 and SharePoint Online. By running an audit log search, you can filter for specific actions and export the raw data for offline analysis.
Sign in to the Microsoft Purview compliance portal using your global administrator or compliance admin account credentials.
In the left navigation pane, scroll down and click on 'Audit' to open the audit log search interface.
Set the Start and End date and time for your search. Under 'Activities', select the specific SharePoint or Microsoft 365 events you wish to investigate. Click the 'Search' button to run the query.
Once the results load on the screen, click the 'Export' button located above the results list. Select 'Download all results' to save the audit log data as a CSV file to your local computer.
Analyze Your Exported Audit Logs with WPS Office
After exporting your Microsoft 365 audit logs as CSV files, you need a reliable spreadsheet tool to analyze the data. WPS Office is a free, lightweight, and powerful alternative to Microsoft Office that easily handles large CSV files, allowing you to filter, format, and organize your compliance reports efficiently.
- 1. Open WPS Spreadsheet: Launch WPS Office on your computer and select the Spreadsheet module.
- 2. Import the CSV File: Click 'Menu', select 'Open', and browse your computer for the exported Microsoft 365 audit log CSV file.
- 3. Format and Analyze Data: Use built-in data filters, pivot tables, and text-to-columns features to clean and interpret the raw audit data effortlessly.
Frequently Asked Questions
Why is the Audit option missing in my Microsoft Purview portal?
You must be assigned specific administrative permissions, such as the View-Only Audit Logs or Audit Logs role in Exchange Online, to view and use the audit search tool in the compliance portal.
How long does Microsoft 365 keep audit log data?
By default, standard audit logs are retained for 180 days. Organizations with Microsoft 365 E5 licenses or Advanced Audit add-ons can configure retention policies to keep logs for up to one year or longer.
Can I automate the export of Microsoft 365 audit logs?
Yes, you can automate log retrieval by using the Office 365 Management Activity API or by writing PowerShell scripts utilizing the Search-UnifiedAuditLog cmdlet to schedule regular exports.
What software should I use to open the exported CSV audit log?
Exported CSV files can be opened and formatted using any standard spreadsheet software. WPS Spreadsheet or Microsoft Excel are recommended, as they allow you to easily expand the JSON data often found within the 'AuditData' column of the log.
