The tables in this section describe the activities that are audited in Office 365. You can search for these events by searching the audit log in the Security & Compliance Center. Click the Search the audit log tab for step-by-step instructions.

These tables group related activities or the activities from a specific Office 365 service. Click a link to go to a specific table The tables include the friendly name that's displayed in the Activities drop-down list and the name of the event that appears in the Operation field in the Office 365 Management API schema and in the CSV file when you export the search results. Click on of the following links to go to a specific table.

File and folder activities
Sharing and access request activities
Synchronization activities
Site administration activities
Exchange mailbox activities
Sway activities
User administration activities
Azure AD group administration activities
Application administration activities
Role administration activities
Directory administration activities
eDiscovery activities
Power BI activities
Microsoft Teams activities
Yammer activities
Exchange admin activities