Audit log activities

The tables in this article describe the activities recorded in the Microsoft 365 audit log. You can search for these activities by searching the audit log in the Microsoft Purview portal.

Audit logging is turned on by default for Microsoft 365 organizations. If auditing isn't turned on for your organization, a banner appears that prompts you to start recording user and admin activity. For instructions, see Turn on auditing.

These tables group related activities or the activities from a specific service. The tables include the friendly name that's displayed in the Activities drop-down list (or that are available in PowerShell) and the name of the corresponding operation that appears in the detailed information of an audit record and in the CSV file when you export the search results. For descriptions of the detailed information, see Audit log detailed properties.

Agent 365 activities

The following table lists Agent 365 activities that are logged when an agent is invoked or performs any actions or tool calls.

Application administration activities

The following table lists application admin activities that Microsoft 365 audit logs when an admin adds or changes an application registered in Microsoft Entra ID. You must register any application that relies on Microsoft Entra ID for authentication in the directory.

Briefing email activities

The following table lists the activities in Briefing email that the Microsoft 365 audit log records. For more information about Briefing email, see:

• Overview of Briefing email
• Configure Briefing email

Communication compliance activities

The following table lists communication compliance activities that the Microsoft 365 audit log records. For more information, see Learn about Microsoft Purview Communication Compliance.

Compliance Manager activities

The following table lists the operations and activities that the audit log records when an admin manages settings in Compliance Manager. For more information, see Learn about Compliance Manager.

Content explorer activities

The following table lists the activities in Content explorer recorded in the Microsoft 365 audit log. You access content explorer on the Data classifications tool in the Microsoft Purview portal. For more information, see Using data classification content explorer.

Data Security Investigations activities

Data Security Investigations provides powerful investigation tools that might require the ability to audit activities to ensure secure and approved use of the solution. To meet these requirements, the unified audit log records Data Security Investigations activities.

The following table lists Data Security Investigations activities that the Microsoft 365 audit log records. For more information, see Learn about Microsoft Purview Data Security Investigations.

Data Security Posture Agent activities

The following table lists the activities for the Data Security Posture Agent in the Microsoft 365 audit log.

Directory administration activities

The following table lists Microsoft Entra directory and domain-related activities that are logged when an administrator manages their organization in the Microsoft 365 admin center or in the Azure management portal.

Disposition review activities

The following table lists the activities a disposition reviewer took when an item reached the end of its configured retention period, or when an item automatically moved to the next disposition stage or was permanently deleted as a result of autoapproval.

Dragon Copilot admin activities

The following table lists administrative activities for Dragon Copilot recorded in the Microsoft 365 audit log. These events are logged when an administrator changes Dragon Copilot configuration. These events include changes in environments, products, Electronic Health Record (EHR) connectors, billing plans, groups, role assignments, settings, and extensions. If your organization uses Dragon Copilot, you can search the audit log for these activities by using the Activities picker list. For more information about Dragon Copilot, see the Dragon Copilot documentation.

You can also search for Dragon Copilot admin activities by running the Search-UnifiedAuditLog -RecordType DragonCopilotAdmin command in Exchange Online PowerShell.

Dragon Copilot Web activities

The following table lists user and application activities for Dragon Copilot Web recorded in the Microsoft 365 audit log. These events capture user access, clinical workflow actions, AI-assisted operations, and session lifecycle events performed within Dragon Copilot Web. Dragon Copilot Web supports clinical documentation workflows including ambient recording, transcript review, AI-assisted note generation, clinical chat, and EHR-integrated experiences.

If your organization uses Dragon Copilot Web, you can search for these activities in Microsoft Purview Audit by selecting the appropriate activity name or by filtering on the Dragon Copilot record types. Audit records are emitted under the following record types:

• DragonCopilotAccess
• DragonCopilotClinicalData
• DragonCopilotSession

You can also search for Dragon Copilot Web audit events by using Search-UnifiedAuditLog and filtering on the corresponding record type.

Dragon Copilot access activities

The following table lists user access and interaction activities for Dragon Copilot recorded in the Microsoft 365 audit log. These events are logged when users access Dragon Copilot or interact with its features and underlying services. These activities include launching Dragon Copilot from an EHR system, accessing Dragon Copilot, and updating patient session data. Events also capture failures related to these operations. If your organization uses Dragon Copilot, you can search the audit log for these activities by using the Activities picker list. For more information about Dragon Copilot, see the Dragon Copilot documentation.

Dragon Copilot clinical data activities

Dragon Copilot session activities

eDiscovery activities

The audit log records eDiscovery activities that you perform in the Microsoft Purview portal. It logs events when administrators or eDiscovery managers (or any user assigned eDiscovery permissions) perform the following tasks in the Microsoft Purview portal:

• Creating and managing eDiscovery cases.
• Creating and editing searches for eDiscovery cases.
• Performing search actions, such as generating statistics, creating a sample, and exporting from search.
• Creating, editing, and removing holds for eDiscovery cases.
• Creating review sets and performing review activities in eDiscovery cases.

For more information about searching the audit log, the permissions that are required, and exporting search results, see Search the audit log.

How to search for and view eDiscovery activities

The audit log records eDiscovery activities that you perform in the Microsoft Purview portal or in PowerShell. To search for eDiscovery activities, see Search for eDiscovery activities in the audit log.

eDiscovery activity reference

The following table lists the eDiscovery activities that are logged when an administrator or eDiscovery manager performs an eDiscovery-related activity by using the Microsoft Purview portal. Some activities performed in the classic eDiscovery user experience might be returned when you search for activities in this list.

Detailed properties for eDiscovery activities

The following table lists the properties that the portal shows on the details page for an eDiscovery activity listed in the search results. These properties are also included in the CSV file when you export the audit log search results. An audit log record for an eDiscovery activity doesn't include every detailed property listed in the following table.

Encrypted message portal activities

Your organization can access logs for encrypted messages through the encrypted message portal. These logs help you determine when your external recipients read and forward messages. For more information about enabling and using encrypted message portal activity logs, see Encrypted message portal activity log.

Each audit entry for a tracked message contains the following fields:

• MessageID: Contains the ID of the message being tracked. Use this key identifier to follow a message through the system.
• Recipient: List of all recipient email addresses.
• Sender: The originating email address.
• AuthenticationMethod: Describes the authenticating method for accessing the message, such as OTP, Yahoo, Gmail, or Microsoft.
• AuthenticationStatus: Contains a value indicating that the authentication succeeded or failed.
• OperationStatus: Whether the indicated operation succeeded or failed.
• AttachmentName: Name of the attachment.
• OperationProperties: A list of optional properties. For example, the number of OTP passcodes sent, or the email subject.

eSignature activities

The following table lists the eSignature activities that the Microsoft 365 audit log records. For more information, see eSignature for Microsoft 365.

Exchange admin activities

Exchange administrator audit logging (which Microsoft 365 enables by default) logs an event in the audit log when an administrator (or a user assigned administrative permissions) makes a change in your Exchange Online organization. The Exchange admin audit log records changes made by using the Exchange admin center or by running a cmdlet in Exchange Online PowerShell. The audit log doesn't record cmdlets that begin with the verbs Get-, Search-, or Test-. For more detailed information about admin audit logging in Exchange, see Administrator audit logging.

Use these tips to search for Exchange admin activities when searching the audit log:

• Use the date range boxes and the Users list to narrow the search results for cmdlets run by a specific Exchange administrator within a specific date range.
• Select the Activity column to sort the cmdlet names in alphabetical order and display events from the Exchange admin audit log.
• Select the Download all results option to export the search results and get information about what cmdlet was run, which parameters and parameter values were used, and what objects were affected. For more information, see Export, configure, and view audit log records.
• Use the Search-UnifiedAuditLog -RecordType ExchangeAdmin command in Exchange Online PowerShell to return only audit records from the Exchange admin audit log. It might take up to 30 minutes after an Exchange cmdlet is run for the corresponding audit log entry to be returned in the search results. For more information, see Search-UnifiedAuditLog. For information about exporting the search results returned by the Search-UnifiedAuditLog cmdlet to a CSV file, see the "Tips for exporting and viewing the audit log" section in Export, configure, and view audit log records.

Exchange mailbox activities

The following table lists the activities recorded in the Microsoft 365 audit log. Mailbox audit logging automatically logs mailbox activities performed by the mailbox owner, a delegated user, or an administrator in the audit log for up to 180 days. An admin can turn off mailbox audit logging for all users in your organization. In this case, no mailbox actions for any user are logged. For more information, see Manage mailbox auditing.

You can also search for mailbox activities by using the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell.

System accounts in Exchange mailbox audit records

In audit records for some mailbox activities, especially Add-MailboxPermissions, you might see the user who performed the activity identified as NT AUTHORITY\SYSTEM or NT SERVICE\MSExchangeAdminApiNetCore(Microsoft.Exchange.AdminApi.NetCore). This system account in the Exchange service in the Microsoft cloud performs scheduled maintenance tasks on behalf of your organization. For example, a common audited activity performed by the NT SERVICE\MSExchangeAdminApiNetCore(Microsoft.Exchange.AdminApi.NetCore) account is updating the permissions on the DiscoverySearchMailbox, which is a system mailbox. This update verifies that the FullAccess permission (which is the default) is assigned to the Discovery Management role group for the DiscoverySearchMailbox. This update ensures that eDiscovery administrators can perform necessary tasks in their organization.

Another system user account that might appear in an audit record for Add-MailboxPermission is Administrator@apcprd03.prod.outlook.com. This service account also appears in mailbox audit records related to verifying and updating the FullAccess permission assigned to the Discovery Management role group for the DiscoverySearchMailbox system mailbox. Specifically, audit records that identify the Administrator@apcprd03.prod.outlook.com account typically trigger when Microsoft support personnel run a role-based access control diagnostic tool on behalf of your organization.

Fabric activities

The following table lists the Microsoft Fabric activities in Power BI that the Microsoft 365 audit log records. You can search the audit log for these activities in Power BI. For information about audit settings, see Audit and usage tenant settings.

File and page activities

The following table lists the file and page activities in SharePoint and OneDrive that the Microsoft 365 audit log records.

Frequently asked questions about FileAccessed and FilePreviewed events

Can non-user activities trigger FilePreviewed audit records that include a user agent like "OneDriveMpc-Transform_Thumbnail"?

There are no known scenarios where non-user actions generate events like these. User actions like opening a user profile card (by selecting their name or email address in a message in Outlook on the web) generate similar events.

Are calls to the OneDriveMpc-Transform_Thumbnail always intentionally triggered by the user?

No. But browser prefetch can result in similar events.

If I see a FilePreviewed event coming from a Microsoft-registered IP address, does that mean the preview shows on the screen of the user's device?

No. Browser prefetch might log the event.

Are there scenarios where a user previewing a document generates FileAccessed events?

Both the FilePreviewed and FileAccessed events indicate that a user's call led to a read of the file (or a read of a thumbnail rendering of the file). While these events are intended to align with preview versus access intention, the event distinction isn't a guarantee of the user's intent.

What causes FileAccessed audit events in Insider Risk Management scenarios?

Creating a case in Insider Risk Management and enabling Content Explorer generates and records a FileAccessed event in the audit log. In this scenario, the event is generated by the Insider Risk Management/Content Explorer workflow rather than by a direct user file-open action, and the same ApplicationId value, 92876b03-76a3-4da8-ad6a-0511ffdf8647, is used for these events. This is important for administrators because it helps distinguish these system-generated FileAccessed events from other FileAccessed activity during an investigation. You can use the ApplicationId field as one of the properties to help identify or filter these specific events when reviewing audit log results.

The app@sharepoint user in audit records

In audit records for some file activities (and other SharePoint-related activities), you might notice the user who performed the activity (identified in the User and UserId fields) is app@sharepoint. This user means that an application performed the activity. In this case, the application was granted permissions in SharePoint to perform organization-wide actions (such as searching a SharePoint site or OneDrive account) on behalf of a user, admin, or service. This process of giving permissions to an application is called SharePoint App-Only access. This user means that an application, instead of a user, presented the authentication to SharePoint to perform an action. This is why the app@sharepoint user is identified in certain audit records. For more information, see Grant access using SharePoint App-Only.

For example, app@sharepoint is often identified as the user for "Performed search query" and "Accessed file" events. That's because an application with SharePoint App-Only access in your organization performs search queries and accesses files when applying retention policies to sites and OneDrive accounts.

Here are a few other scenarios where app@sharepoint might be identified in an audit record as the user who performed an activity:

• Microsoft 365 Groups. When a user or admin creates a new group, audit records are generated for creating a site collection, updating lists, and adding members to a SharePoint group. An application performs these tasks on behalf of the user who created the group.
• Microsoft Teams. Similar to Microsoft 365 Groups, audit records are generated for creating a site collection, updating lists, and adding members to a SharePoint group when a team is created.
• Compliance features. When an admin implements compliance features, such as retention policies, eDiscovery holds, and autoapplying sensitivity labels.

In these and other scenarios, you might also notice that multiple audit records with app@sharepoint as the specified user were created within a short time frame, often within a few seconds of each other. This pattern also means they were probably triggered by the same user-initiated task. Also, the ApplicationDisplayName and EventData fields in the audit record might help you identify the scenario or application that triggered the event.

Folder activities

The following table lists the folder activities in SharePoint and OneDrive recorded in the Microsoft 365 audit log. Audit records for some SharePoint activities indicate the app@sharepoint user performed the activity on behalf of the user or admin who initiated the action. For more information, see The app@sharepoint user in audit records.

Forms activities

The following table lists the user and admin activities in Microsoft Forms that the Microsoft 365 audit log records. Microsoft Forms is a forms, quiz, and survey tool you can use to collect data for analysis. Some operations include additional activity parameters, as noted in the descriptions.

If a coauthor or an anonymous responder performs a Forms activity, the audit log records it slightly differently. For more information, see the Forms activities performed by coauthors and anonymous responders section.

Forms activities performed by coauthors and anonymous responders

Forms supports collaboration when designing forms and analyzing responses. A form collaborator is known as a coauthor. Coauthors can do everything a form owner can do, except delete or move a form. Forms also allows you to create a form that can be responded to anonymously. This means the responder doesn't have to sign in to your organization to respond to a form.

The following table lists the auditing activities and information recorded in the Microsoft 365 audit log for activities performed by coauthors and anonymous responders.

Information barriers activities

The following table lists the activities in Information Barriers that the Microsoft 365 audit log records. For more information about Information Barriers, see Learn about Information Barriers in Microsoft 365.

Microsoft 365 Admin Center Agent Management activities

The following table lists Agent Management activities that the Microsoft 365 audit log records. For more information, see Manage Microsoft 365 Copilot agents in the Microsoft 365 admin center.

Microsoft 365 Apps Admin Services cloud policy activities

The following table lists the activities for policy configuration changes in the Cloud Policy service that the Microsoft 365 audit log records.

Microsoft 365 Apps Admin Services cloud update activities

The following table lists the activities for configuration changes and triggered actions in the Cloud Update service that the Microsoft 365 audit log records.

Microsoft 365 Backup activities

The following table lists the activities in Microsoft 365 Backup that the Microsoft 365 audit log records. Microsoft 365 Backup is designed to ensure your organization's data is always protected and easily recoverable. For more information about Microsoft 365 Backup, see Overview of Microsoft 365 Backup.