Need to find if a user viewed a specific document or purged an item from their mailbox? If so, you can use the Office 365 Security & Compliance Center to search the unified audit log to view user and administrator activity in your Office 365 organization. Why a unified audit log? Because you can search for the following types of user and admin activity in Office 365:

  • User activity in SharePoint Online and OneDrive for Business

  • User activity in Exchange Online (Exchange mailbox audit logging)

IMPORTANT: Mailbox audit logging must be turned on for each user mailbox before user activity in Exchange Online will be logged. 

  • Admin activity in SharePoint Online

  • Admin activity in Azure Active Directory (the directory service for Office 365)

  • Admin activity in Exchange Online (Exchange admin audit logging)

  • User and admin activity in Sway

  • User and admin activity in Power BI for Office 365

  • User and admin activity in Microsoft Teams

  • User and admin activity in Yammer

NOTE: Activity logging for Yammer might not be available yet to applicable customers.