← Back to the guide

Microsoft 365 audit log query patterns

5slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M

solvingmicrosoft365.com

1 / 5

Microsoft 365 audit log query patterns

Practical patterns for finding what you need in the unified audit log — investigations, compliance, and routine checks.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/audit-log-query-patterns

Slide 1Download PNG

M

solvingmicrosoft365.com

2 / 5

01

Where to search

Two main surfaces:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/audit-log-query-patterns

Slide 2Download PNG

M

solvingmicrosoft365.com

3 / 5

02

Search structure

Every audit search needs:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/audit-log-query-patterns

Slide 3Download PNG

M

solvingmicrosoft365.com

4 / 5

03

Common investigation patterns

### Mailbox compromise — what did the attacker do?

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/audit-log-query-patterns

Slide 4Download PNG

M

solvingmicrosoft365.com

5 / 5

04

Audit retention by tier

For investigations of events older than retention, the data is gone — there's no recovery. Plan retention deliberately for compliance use cases.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/audit-log-query-patterns

Slide 5Download PNG

Auto-generated from Microsoft 365 audit log query patterns. This page is not indexed and isn't part of the guide itself.