Auditing sharing activity

After you have configured the and security settings, you may need to audit sharing settings to ensure that your organizational policies are being met or to investigate issues.

You can perform auditing by searching the Audit Log in the Security & Compliance Center. If it hasn't been turned in on your environment, you will need to enable the auditing features. We will cover this in this section.

Enabling the Unified Audit Log

To capture all of the auditable events, you should ensure that the Unified Audit Log is turned on. This can be done from either the Security & Compliance Center or through PowerShell. Both methods will be described in this section.

...