Enterprise audit log search, security investigation, and compliance reporting across Microsoft 365 — MS-102 implementation lab
Microsoft Purview Audit provides a centralised, searchable record of user, administrator, application, and service activities across Microsoft 365 workloads. When a security incident occurs — whether a data breach, insider threat event, or compliance violation — the Unified Audit Log (UAL) is the primary data source for forensic investigation.
This repository documents an enterprise implementation of Microsoft Purview Audit, covering audit configuration verification, targeted audit searches, structured investigation workflow, log export for evidence preservation, and integration with compliance reporting processes.
| Attribute | Value |
|---|---|
| Tenant | securem365lsb.onmicrosoft.com |
| Workloads Covered | Exchange Online, SharePoint Online, OneDrive, Teams, Entra ID |
| Audit Tier | Audit Standard |
| Investigation Scenario | Insider Threat — File Access Pattern Analysis |
| Events Captured | 12 FileAccessed events (testuser1, 2026-07-02) |
| Export Format | CSV — chain-of-custody evidence |
| Challenge | Impact |
|---|---|
| No visibility into who accessed sensitive SharePoint documents | Unable to investigate potential data exfiltration |
| File deletions occur with no accountability record | Security team cannot determine scope of data loss |
| Privileged account actions not reviewed systematically | Compliance gap for administrator accountability |
| Security incidents investigated reactively, without data | Mean time to investigate (MTTI) is days, not hours |
| Regulatory auditors require evidence of monitoring controls | Failed audits, potential fines, remediation costs |
- Audit Trail — Every user and administrator action across M365 workloads must generate a searchable audit record
- Targeted Search — Security team must be able to search by user, date range, workload, and activity type
- Investigation Workflow — Structured process for investigating file access, deletion, sharing, and admin changes
- Evidence Export — Audit results must be exportable to CSV for legal hold and forensic reporting
- Compliance Reporting — Audit data must support regulatory requirements (ISO 27001, GDPR Article 5)
- Retention — Audit records retained for a minimum of 90 days (Audit Standard)
Microsoft Purview Audit addresses all requirements through the Unified Audit Log:
- Unified Audit Log — Centralised repository capturing activities from all M365 workloads
- Audit Search — Configurable search by date range, user, activity type, file, and workload
- Activity Filters — Granular filters for file operations, mailbox access, Teams events, admin changes
- Export to CSV — Full audit export with JSON
AuditDatafield for forensic analysis - Audit Standard — 90-day retention, full search capability, CSV export (included in E3/E5)
- Audit Premium — Extended retention (1–10 years), high-value audit events, advanced investigation (requires E5)
| Component | Detail |
|---|---|
| Tenant | Microsoft 365 E5 Trial |
| Admin Portal | compliance.microsoft.com |
| Test Account | testuser1@securem365lsb.onmicrosoft.com |
| Investigation Period | 2026-07-01 to 2026-07-03 |
| Activity Investigated | FileAccessed (SharePoint Online) |
| Files Accessed | GSM-Test.docx, GSM Confidential Documents |
| Total Events Found | 12 audit records |
┌──────────────────────────────────────────────────────────────────────┐
│ MICROSOFT 365 AUDIT ARCHITECTURE │
│ compliance.microsoft.com │
└──────────────────────────────────────────────────────────────────────┘
ACTIVITY SOURCES UNIFIED AUDIT LOG INVESTIGATION TOOLS
┌──────────────┐ ┌────────────────────┐ ┌──────────────────┐
│ Exchange │─────────▶│ │────▶│ Audit Search │
│ Online │ │ UNIFIED AUDIT │ │ Date/User/ │
└──────────────┘ │ LOG │ │ Activity Filter │
┌──────────────┐ │ │ └──────────────────┘
│ SharePoint │─────────▶│ 90-day Standard │ ┌──────────────────┐
│ Online │ │ 1–10yr Premium │────▶│ Results Review │
└──────────────┘ │ │ │ Activity/User/ │
┌──────────────┐ │ Record Types: │ │ IP/Workload │
│ OneDrive │─────────▶│ • SharePoint │ └──────────────────┘
└──────────────┘ │ • Exchange │ ┌──────────────────┐
┌──────────────┐ │ • AzureAD │────▶│ CSV Export │
│ Microsoft │─────────▶│ • MicrosoftTeams │ │ Evidence │
│ Teams │ │ • OneDrive │ │ Preservation │
└──────────────┘ │ • SecurityCompli │ └──────────────────┘
┌──────────────┐ └────────────────────┘ ┌──────────────────┐
│ Entra ID │─────────────────────────────────────▶│ PowerShell │
└──────────────┘ │ Automation │
└──────────────────┘
Navigate to compliance.microsoft.com → Solutions → Audit. Verify audit is enabled for the tenant. By default, auditing is enabled for Microsoft 365 organizations, but this must be confirmed before relying on audit data for investigations.
Key Verification Points:
- Auditing status shows as enabled
- All workloads appear in the audit solution
- Administrative accounts have Audit Logs or View-Only Audit Logs role assigned
Navigate to Audit → Search. Configure the search parameters:
| Parameter | Value | Purpose |
|---|---|---|
| Date Range | 2026-07-01 to 2026-07-03 | Scope investigation window |
| Activities | FileAccessed | Target specific operation type |
| Users | testuser1 | Scope to single identity |
| Record Types | SharePointFileOperation | Filter by workload |
Submit the search and monitor progress. The audit search is asynchronous — results are returned progressively as the UAL is queried across all storage partitions.
Results Summary:
- Search status: Completed (100%)
- Total events returned: 12 audit records
- Search identifier:
Jul 1 – Jul 3 testuser1 fileaccessed
Review returned audit events. Each record contains:
| Field | Description |
|---|---|
| Date (UTC) | Timestamp of activity |
| User | Identity performing the action |
| Activity | Operation type (FileAccessed, FileDeleted, etc.) |
| Record Type | Workload source (SharePointFileOperation) |
| IP Address | Client IP at time of action |
| Item | Affected file or resource |
Investigation Findings:
- User: testuser1@securem365lsb.onmicrosoft.com
- Files Accessed: GSM-Test.docx, GSM Confidential Documents
- Date: 2026-07-02
- Record Type: SharePointFileOperation (Record Type 6)
- Pattern: 12 file access events in a focused time window — consistent with data reconnaissance
Select Export Results to download a full CSV export of all matching audit events. The export preserves complete AuditData JSON for each record, providing full forensic context.
Export Output:
- Format: CSV with AuditData JSON column
- Columns: RecordId, CreationDate, RecordType, Operation, UserId, AuditData
- Records: 12 rows
- Evidence status: Preserved for compliance and incident response
Open the exported CSV in Excel to verify completeness and accuracy. All 12 events confirmed present with full audit context.
Export Field Validation:
| Column | Value Confirmed |
|---|---|
| RecordId | Unique GUID per record |
| CreationDate | 2026-07-02 (UTC) |
| RecordType | 6 (SharePoint) |
| Operation | FileAccessed |
| UserId | testuser1@securem365lsb.onmicrosoft.com |
| AuditData | Full JSON with session IDs and client app details |
| Test Case | Description | Result |
|---|---|---|
| TC-AUD-01 | Audit solution accessible at compliance.microsoft.com → Solutions → Audit | ✅ Pass |
| TC-AUD-02 | Audit search executes with date, user, and activity filters | ✅ Pass |
| TC-AUD-03 | Search completes with 12 results for testuser1 FileAccessed | ✅ Pass |
| TC-AUD-04 | Audit results display Activity, User, IP, Date, RecordType fields | ✅ Pass |
| TC-AUD-05 | Export completes and CSV downloads successfully | ✅ Pass |
| TC-AUD-06 | CSV validates in Excel with all 12 records and AuditData JSON intact | ✅ Pass |
| Script | Purpose |
|---|---|
Search-UnifiedAuditLog.ps1 |
Targeted audit log search with activity, user, and date filters |
Export-AuditLogs.ps1 |
Bulk audit export to CSV and JSON with retention-aware batching |
Get-AuditConfiguration.ps1 |
Audit configuration audit — enabled status, mailboxes, admin roles |
# Quick audit search example
.\Search-UnifiedAuditLog.ps1 `
-StartDate "2026-07-01" `
-EndDate "2026-07-03" `
-UserIds "testuser1@securem365lsb.onmicrosoft.com" `
-Operations "FileAccessed" `
-OutputPath "C:\AuditExports"| Feature | Audit Standard | Audit Premium |
|---|---|---|
| Audit Search | ✅ | ✅ |
| Export to CSV | ✅ | ✅ |
| Retention | 90 days | 1–10 years |
| High-Value Events | Limited | Enhanced (MailItemsAccessed, Send) |
| Advanced Investigation | ❌ | ✅ |
| Licensing | E3 / E5 | E5 / Compliance Add-On |
| This Lab | ✅ Standard | — |
- Audit is enabled by default — but verify before an incident occurs. Many organizations assume it is active without checking.
- Search scope determines performance — broad date ranges across all users can be slow. Targeted searches (specific user, activity, and date range) return results faster and are easier to analyse.
- AuditData JSON is the forensic record — the CSV columns are metadata; the
AuditDataJSON field contains the complete activity context including client IP, session IDs, browser agent, and exact resource path. - Export early — Audit Standard retains logs for 90 days. Export and preserve evidence immediately when an incident is identified; do not rely on the portal for long-term retention.
- Audit Premium required for mailbox reads — the
MailItemsAccessedevent (critical for email breach investigation) is an Audit Premium–only event.
| Issue | Likely Cause | Resolution |
|---|---|---|
| Audit solution not visible | Missing role | Assign Audit Logs or View-Only Audit Logs role |
| Search returns no results | Audit not enabled | Run Get-AdminAuditLogConfig to verify |
| Events missing for a user | User excluded from audit | Check per-user audit settings in Exchange |
| Export fails silently | Permissions issue | Verify Compliance Administrator or eDiscovery roles |
| AuditData column is empty | CSV parsing issue | Open CSV in Excel; use Data → Text Import for large files |
| Search times out | Overly broad scope | Narrow date range or add user/activity filters |
- Configure Audit Premium for extended retention and
MailItemsAccessedevents - Create scheduled PowerShell jobs for weekly audit log export
- Build Power BI dashboard connected to exported audit CSV
- Integrate audit alerts with Microsoft Sentinel for real-time incident creation
- Configure audit retention policies for specific record types (3-year for admin actions)
- Implement audit log archival to Azure Blob Storage for long-term compliance
Microsoft-Purview-Audit/
├── README.md # This document
├── LICENSE # MIT License
├── .gitignore # Excludes credentials, exports, logs
├── GITHUB-METADATA.md # Repository metadata and push guide
├── WEBSITE-PORTFOLIO-CARD.md # Portfolio card HTML block
├── architecture/
│ └── purview-audit-architecture.md # 4 Mermaid architecture diagrams
├── docs/
│ ├── 01-overview.md # What is Purview Audit, architecture, licensing
│ ├── 02-enable-audit.md # Enabling and verifying audit
│ ├── 03-audit-search.md # Configuring and running audit searches
│ ├── 04-investigation.md # Investigation workflow and findings
│ ├── 05-export-results.md # Exporting audit logs for evidence
│ ├── 06-validation.md # 6 test cases with pass results
│ ├── troubleshooting.md # 6 common issues and resolutions
│ └── screenshots-placement-guide.md # Screenshot index and placement map
├── images/
│ ├── 02-enable-audit/ # Audit solution screenshots
│ ├── 03-audit-search/ # Search configuration and progress
│ ├── 04-investigation/ # Audit results screenshots
│ ├── 05-export-results/ # Export workflow screenshots
│ └── 06-validation/ # CSV validation in Excel
└── scripts/
├── Search-UnifiedAuditLog.ps1 # Targeted audit search automation
├── Export-AuditLogs.ps1 # Bulk audit log export
└── Get-AuditConfiguration.ps1 # Audit configuration audit