Exporting Office 365 audit logs

Open: https://protection.office.com/#/homepage

Login with your tenant admin account. It may be that you can use an account with less excessive rights, however I can’t test that at this moment.

Office 365 Protection Center

In the Protection Center, click on Reports in the left hand navigation pane, then click on View Reports

Office 365 Protection Center Reports
Then click on Office 365 audit log report in the main body of the page

This will open a popup that can show you the audit log.

Select an appropriate Start date, normally 1 month in the past. By default it will start with only the last week selected and will not allow you get more than a month of data at one time, probably to reduce the data size to something more manageable.
(Correction: You can do more than a month, I just hit issues because I selected the day I started logging, which failed because I started logging at mid-day but asked for logs from the start of the day)
Select date range for audit report

Click Search to get all the audit logs for that period.

Scroll to the top right corner, in the ridiculously small window that you can’t even re-size in my older version of IE.

Click on Export Results and in the dropdown click on Download all results

Export results from Office 365
This will give you a file download dialog
Confirmation save box

Save the file, or Save As to pick the location

It will then download the file, this may take some time, in limited tests I have seen ~100KB/sec transfer and file sizes of approximately 4-6MB per user per month.

Zip the file up before sending it anywhere, the content is highly compressible with roughly 95% reduction in size.
Compressed and uncompressed log files

Leave a Reply

Your email address will not be published. Required fields are marked *