Glossary
Audit Log
By Emil Björk · Microsoft ecosystem consultant, Gothenburg
Microsoft Purview's unified audit log of administrative and user actions across Microsoft 365.
The Microsoft Purview audit log records administrative and user actions across Microsoft 365 — mailbox access, file activity, sign-ins, permission changes, sharing, eDiscovery operations, Copilot interactions. Searchable in the Purview portal and via the Office 365 Management Activity API. Retention is 180 days on Microsoft 365 E3 and 1 year on E5, extensible to 10 years with the Audit (Premium) add-on. The first stop for compliance investigations, incident forensics, and answering "who did what when." Different from Defender XDR logs (security-event focused) and Entra ID sign-in logs (auth focused), though signals cross-reference between systems.
Worked example
A sensitive contract goes missing from a SharePoint library and the finance director wants to know who deleted it and when. A Purview audit log search filtered to that file's activity shows exactly who opened it, when it was moved, and the timestamp of the deletion — evidence that would otherwise only exist as someone's memory of what happened. Because the tenant is on Microsoft 365 E3 with 180 days of default retention, the search only works because the deletion happened recently; had it happened eight months ago, the E3 tenant's audit trail for that event would already be gone.
Common pitfalls
Assuming the audit log retains everything indefinitely is the most consequential misunderstanding — the default retention (180 days on E3, one year on E5) means an investigation into anything older than that window comes up empty unless the Audit (Premium) add-on with its 10-year retention was already turned on before the event happened, not after. Searching the audit log for a security incident and expecting the same detail Defender XDR provides is a mismatch of tools — the audit log answers "who did what, when" across the whole platform, while Defender XDR is built for correlating and investigating actual attacks. And forgetting that Copilot interactions are logged here too means "what did Copilot access on my behalf" is a legitimate audit-log question some organisations don't think to ask until a specific compliance requirement forces it.