Skip to content
← Back to the guide

How to search the audit log in Microsoft Purview

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

How to search the audit log in Microsoft Purview

How to search the Microsoft 365 unified audit log in Purview: check it's on, search by activity, user, and date, export, and Search-UnifiedAuditLog at scale.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Is the Microsoft 365 audit log enabled by default?

Yes, for tenants created since 2019 unified audit logging is on by default. Older tenants, or tenants where someone turned it off, need it enabled once in the Purview Audit page or with Set-AdminAuditLogConfig -UnifiedA…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

How far back does the audit log go?

180 days by default for all Microsoft 365 licences (raised from 90 in 2023). Users with E5, E5 Compliance, or the Audit Premium add-on get one year, extendable to ten with the 10-Year Audit Log Retention add-on. Retenti…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Why does my audit search return nothing for something that definitely happened?

Latency: most workloads take 30–60 minutes to appear, Exchange and Entra events usually faster, some SharePoint events longer. Scope: the search's date range and time zone (the portal uses UTC), or the activity picker f…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Step 1: Open the search

Purview portal → Solutions → Audit → Search. The page lists previous searches (they are saved jobs, not live queries).

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Step 2: Set the scope

Set the scope

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Step 3: Run and read

Search. The job queues and runs, from seconds to a few minutes. Results show date, IP, user, activity, item, and detail; clicking a row opens the full JSON AuditData, which is where the interesting fields live — ClientI…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Step 4: Export

Export on a completed search produces a CSV of up to 50,000 rows (portal limit). The AuditData column is JSON per row; expand it in Excel with Power Query (From Table → Parse JSON) or in PowerShell. For more than 50,000…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/how-to-search-the-audit-log-in-microsoft-purview

Slide 8Download PNG

Auto-generated from How to search the audit log in Microsoft Purview. This page is not indexed and isn't part of the guide itself.