How to Search and Investigate with the Audit Log in Microsoft Purview

Introduction

The unified audit log in Microsoft Purview is the record of every user and admin action taken across your Microsoft 365 environment. Every file accessed, every email forwarded, every label changed, every permission modified – it is all there. When Content Explorer shows you sensitive data and Activity Explorer shows you something unusual happened, the audit log is where you go to reconstruct exactly what occurred, when, and by whom.

The audit log requires specific licensing. With Microsoft 365 E3, you get 90 days of retention. With E5 or the Compliance add-on, you get one year. You also need the Audit Logs or View-Only Audit Logs role assigned through Purview permissions. If records are missing, check your retention period – data beyond your license window may already be gone.

How to Construct a Search That Returns What You Actually Need

Go to the Purview compliance portal, expand Audit, and click Search. The date range and activities filter work together as an AND condition. If you set the last 7 days and select FileDownloaded, you only see downloads in that window. Leave activities blank and you get every audited action – often too much data to be useful.

The users field narrows results to specific people. The file, folder, or site field filters by the item that was acted upon – useful when you know which document was involved but not who accessed it. The Record type dropdown defaults to everything but selecting a specific type – Exchange, SharePoint, Azure AD – dramatically speeds up searches by limiting to one service’s audit feed.

The Five Most Useful Audit Searches You Will Run Repeatedly

What did a specific user do in the last 48 hours? Set the date range to 2 days, enter the user’s email, and leave activities blank. Sort by date and scroll chronologically. Look for anomalies – unusual file access outside working hours, label removals followed by external forwarding, downloads from unfamiliar locations.

Who accessed a specific file? Enter the file name in the file field, set the date range, and select FileAccessed and FileDownloaded. Useful when sensitive data leaked and you need to trace exposure. Combine with eDiscovery if you need to preserve the file and related communications for legal review.

What emails were forwarded externally? Select Exchange as the record type, choose MailItemsAccessed and external forwarding activities, and filter by user. External forwarding events include the destination address in the details pane. If you spot suspicious forwarding, cross-reference with insider risk alerts for the same user.

Who changed sharing permissions on a SharePoint site? Select SharePoint, choose AddedToSite and sharing modification activities. This reveals permission changes that could indicate an attacker or insider broadening access. If sharing was modified immediately before a DLP policy triggered, check the DLP alerts for that time window.

What happened in the hour before and after a security alert? When Microsoft Defender or Sentinel raises an alert, set a narrow date range centered on the alert timestamp and search for the user or device involved. Look for reconnaissance before the alert and data movement after it. This timeline reconstruction is often the difference between a contained incident and a missed exfiltration.

Exporting Results and Using PowerShell for Advanced Searches

The web interface is good for quick searches, but for recurring investigations or large result sets, export to CSV. Click Export after running a search to download results. The AuditData column contains a JSON blob with the full audit record – parse it in Excel to extract exact file paths, client IPs, and user agents. For searches returning more than 50,000 records, the export splits across multiple files.

For programmatic access, use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell. A basic search: Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations "FileDownloaded" -UserIds "user@domain.com" -ResultSize 5000. The cmdlet returns up to 5,000 records per call. For larger searches, loop through pages using SessionId parameters. If audit log searches are part of a larger investigation that requires legal hold and case management, eDiscovery provides the proper workflow.