Logging is very important, I highly recommend you enable audit logs for SharePoint Online, OneDrive, and Azure AD. Be proactive and get these enabled ASAP before you run into a situation where you need them only to discover they were never enabled. Taking things to the next level you can collect O365 management events from the following applications through the Office 365 Management Activity API. In this first part of the series we will enable auditing for SharePoint, OneDrive, and Azure AD.
Enable Auditing for SharePoint, OneDrive, and Azure AD
- Login to http://portal.office.com
Skip to step 5 if you go directly to the security & compliance portal with this link https://protection.office.com/homepage - Launch the Admin app.
- Drop down Admin Centers and select Security.
- Select More resources and Open the Office 365 security & compliance center.
- Drop down Search and select Audit Log Search.
- Click the Start recording user and admin activities link.
Note: If you do not see the Start recording user and admin activities link, then auditing for SharePoint, OneDrive, and Azure AD has already been enabled.
