Performing an audit log search

Now that we have auditing log searches enabled on our Microsoft 365 tenant, we can search a unified audit log to view a wide range of user or administrator actions. Some examples of these actions include the following:

• A user renames a file.
• A user creates a list in SharePoint.
• An administrator changes a device's access policy.
• A user removes a sensitivity label from a file.

These are only a few examples from an extremely comprehensive list of possible activities that can be interrogated using the audit log.

In the following example, we will interrogate the audit log to show us when a user has downloaded files to their computer. In order to do this, we need to carry out the following steps:

1. From the Security & Compliance Center, navigate to Search | Audit log search. You will see the Audit log search tool, as in the following screenshot:
   

   Figure 15.12 – Audit log search

2. Under Activities, click on...