IT Operations & Cybersecurity Encyclopedia
Microsoft 365 audit log review guide
Microsoft 365 audit logs help IT and security teams investigate privileged changes, sign-in activity, mailbox actions, file access, sharing, Teams activity, app consent, and suspicious behavior. A professional review process defines which events matter, who reviews them, how often, what evidence is retained, and when findings are escalated.
Purview auditSign-in logsAdmin activityMailbox actionsEvidence review
Why it matters
Turn Microsoft 365 logs into usable security and operations evidence
Microsoft 365 audit logs are useful only when they are enabled, retained long enough, reviewed with purpose, and connected to response workflows. Raw logs without scope, ownership, or escalation rarely help during an incident.
A mature audit-log review process should cover privileged activity, risky sign-ins, mailbox access, file sharing, app consent, Teams activity, data access, policy changes, and user lifecycle events.
This guide is operational planning guidance. It does not replace Microsoft documentation, a cybersecurity audit, legal hold/eDiscovery process, incident response retainer, or compliance review.
Practical rule: Every audit-log review should define scope, time window, event types, reviewer, evidence export, severity, escalation path, ticket owner, and closure decision.
Review scope
Microsoft 365 audit log review areas
Audit readiness
Confirm audit availability, retention, reviewer roles, export process, evidence storage, and escalation workflow.
Identity and sign-in activity
Review risky users, admin sign-ins, MFA failures, location anomalies, device details, and conditional access outcomes.
Privileged and admin changes
Track role assignments, policy changes, mailbox permissions, app consent, transport rules, and tenant settings.
Email and mailbox activity
Review forwarding, inbox rules, send-as behavior, mailbox access, delegate changes, and suspicious email actions.
Files and collaboration
Review SharePoint, OneDrive, Teams, external sharing, guest access, downloads, permissions, and site changes.
Investigation and reporting
Convert searches into findings, tickets, owner actions, evidence exports, incident timelines, and executive summaries.
Review matrix
Microsoft 365 audit log review matrix
| Area | What to verify | Questions to answer | Evidence |
|---|---|---|---|
| Readiness | Review audit status, retention, reviewer roles, export process, evidence storage, and escalation procedure. | Can logs support an investigation today? | Audit configuration, retention notes, role list, export sample, and evidence storage record. |
| Identity | Review sign-ins, risky users, MFA failures, admin access, conditional access results, devices, and locations. | Which sign-ins deserve investigation? | Sign-in export, risky-user list, CA result samples, ticket notes, and analyst comments. |
| Admin changes | Review role changes, password resets, app consent, mailbox permissions, transport rules, and policy changes. | Were privileged changes approved and expected? | Audit search export, change ticket, approval note, owner confirmation, and rollback evidence. |
| Mailbox | Review inbox rules, forwarding, send-as, delegate access, mailbox logons, and suspicious email actions. | Could mailbox activity indicate compromise? | Mailbox audit export, forwarding report, rule list, delegate changes, and remediation notes. |
| Files | Review sharing links, external access, mass downloads, permission changes, site admin changes, and sensitive access. | Is data access appropriate and explainable? | File activity export, sharing report, permission review, owner decision, and containment action. |
| Closure | Review findings, severity, escalation, containment, remediation, evidence retention, and final owner approval. | Was the review closed with defensible evidence? | Investigation summary, ticket, timeline, exports, remediation record, and closure approval. |
Step-by-step review
Microsoft 365 audit log review runbook
1
Confirm audit access and retention
Validate Purview audit access, retention expectations, reviewer roles, search permissions, export process, and evidence storage.
2
Define review scope and time window
Select event types, users, workloads, privileged accounts, affected services, date range, and business reason for the review.
3
Search high-risk activities
Review admin changes, risky sign-ins, mailbox forwarding, inbox rules, app consent, external sharing, downloads, and policy changes.
4
Correlate with tickets and alerts
Compare audit events against change tickets, help desk records, Defender alerts, sign-in logs, user reports, and service incidents.
5
Escalate suspicious findings
Assign severity, notify owners, open tickets, preserve exports, contain accounts or sharing links, and document response steps.
6
Report closure and improvements
Summarize findings, root cause, evidence, remediation, residual risk, policy improvements, owner actions, and next review date.
Common risks
Common Microsoft 365 audit log review gaps
Logs reviewed only after incidents
Reactive-only review makes suspicious trends harder to catch and evidence harder to preserve.
No event scope
Searching without clear event types, workloads, users, and time windows creates noise and missed findings.
Privileged changes not reconciled
Admin changes should be compared against tickets and approvals, not assumed to be legitimate.
Mailbox rules ignored
Forwarding and inbox rules are common signs of mailbox compromise and should be reviewed.
Sharing evidence incomplete
External sharing and mass downloads need owner decisions and containment steps when unusual.
Exports not preserved
Investigations lose value when search criteria, exports, timestamps, and closure notes are not retained.
Related support
Where IT Perfection can help
IT Perfection can help organizations operate Microsoft 365 audit-log review workflows, user support, change tracking, and escalation processes.
OC Security Audit can help assess Microsoft 365 security evidence, audit logs, mailbox compromise indicators, privileged activity, and incident-readiness controls.
Created by Ali Hassani, CISO
Professional Microsoft 365 audit-log review support
Ali Hassani brings 25+ years of hands-on experience across IT operations, cybersecurity, Microsoft infrastructure, network security, compliance readiness, cloud services, healthcare IT, MSP services, and business technology leadership.
This guide is for initial education and planning. It does not replace a professional cybersecurity audit, compliance assessment, penetration test, legal review, vendor engineering review, or Microsoft professional services engagement.
Audit logs should produce action, not only exports
A disciplined log review program improves investigation quality, privileged-change accountability, mailbox compromise response, sharing governance, and executive evidence.
FAQ
Microsoft 365 audit log review FAQ
What should be reviewed in Microsoft 365 audit logs?
Review privileged changes, sign-ins, mailbox forwarding and inbox rules, app consent, external sharing, file access, Teams activity, and sensitive policy changes.
How often should audit logs be reviewed?
High-risk activity should be reviewed on a recurring schedule and immediately during incidents, suspicious user reports, privileged changes, or data exposure concerns.
What evidence should be kept?
Keep search criteria, time windows, exports, screenshots where useful, tickets, owner decisions, containment actions, remediation, and closure notes.
Can audit logs prove whether an account was compromised?
Audit logs can provide strong evidence, but they should be correlated with sign-in logs, Defender alerts, user reports, endpoint evidence, and incident response findings.
