How to search the audit log in Microsoft Purview

Searching the audit log in Microsoft Purview is a form — date range, activities, users, file or site — that returns the unified record of who did what across Exchange, SharePoint, OneDrive, Teams, Entra, and the rest. For a quick "who deleted this file" the portal is enough; for anything spanning thousands of events or repeatable investigations, Search-UnifiedAuditLog in PowerShell (or the Graph audit API) is the tool, with its paging quirks understood.

Reading the log well — which record types matter, the query patterns for common investigations, and how retention tiers affect what you can find — is in Microsoft 365 audit log query patterns and Purview audit retention. This page is the mechanics of a single search.

Prerequisites

• Role: Audit Reader or Audit Manager in Purview (assigned via Purview → Settings → Roles and scopes), or the Exchange View-Only Audit Logs role for PowerShell. Global Reader can search too.
• Audit enabled: Purview → Solutions → Audit shows a banner with a Start recording user and admin activity button if not.
• Exchange Online PowerShell module (Connect-ExchangeOnline) for the cmdlet route — the audit cmdlet lives in the Exchange module despite being tenant-wide.
• For Entra sign-in specifics, remember the sign-in logs are richer than the audit log; the audit log is for actions, not authentications.

Steps

1. Open the search

Purview portal → Solutions → Audit → Search. The page lists previous searches (they are saved jobs, not live queries).

2. Set the scope

• Date and time range: UTC. Start narrow (a day) for a specific incident; widen if empty.
• Activities — friendly names: pick from categories (e.g. File and page activities → Deleted file, Sharing and access request activities → Created anonymous link, Exchange mailbox activities → New-InboxRule). Leave empty for all activities on a user — slower but complete.
• Activities — operation names: the raw operation strings (FileDeleted, AnonymousLinkCreated, Set-Mailbox) if you know them.
• Record types: optional filter by workload.
• Users: the UPNs of interest; empty for everyone.
• File, folder, or site: a URL fragment — Contracts/2026 matches any path containing it.
• Keyword search: free text against the record; useful for an IP address or an object name.

3. Run and read

Search. The job queues and runs, from seconds to a few minutes. Results show date, IP, user, activity, item, and detail; clicking a row opens the full JSON AuditData, which is where the interesting fields live — ClientIP, UserAgent, ObjectId, Parameters for admin cmdlets, TargetUserOrGroupName for sharing.

4. Export

Export on a completed search produces a CSV of up to 50,000 rows (portal limit). The AuditData column is JSON per row; expand it in Excel with Power Query (From Table → Parse JSON) or in PowerShell. For more than 50,000 rows, use step 5.

5. PowerShell for scale and repeatability

Connect-ExchangeOnline
$start = (Get-Date).AddDays(-7); $end = Get-Date
$sessionId = "inv-2026-014"
$all = @()
do {
  $batch = Search-UnifiedAuditLog -StartDate $start -EndDate $end -Operations FileDeleted,FileDeletedFirstStageRecycleBin `
            -UserIds user@contoso.com -SessionId $sessionId -SessionCommand ReturnLargeSet -ResultSize 5000
  $all += $batch
} while ($batch.Count -eq 5000)
$all | Select-Object CreationDate,UserIds,Operations,@{n="Object";e={($_.AuditData|ConvertFrom-Json).ObjectId}} |
  Export-Csv .\deleted-files.csv -NoTypeInformation

SessionCommand ReturnLargeSet pages through up to 50,000 results per session; for more, split the date range. Results are not guaranteed in order — sort after collecting. The Graph auditLogs and Purview Audit Search Graph API are the alternatives when you want a service principal rather than an admin session.

Verify

• A known action — delete a test file in OneDrive, create an inbox rule — appears in a search of the last hour once latency passes.
• Row counts from the portal and from PowerShell for the same scope match (within the portal's 50,000 cap).
• Get-AdminAuditLogConfig | Select UnifiedAuditLogIngestionEnabled returns True.

Roll back

Searching changes nothing; there is nothing to roll back. What you cannot undo is not having the log: if audit was off, or the retention period passed, the events are gone. Check the retention tier for the users involved before promising an answer, and for incidents that may need more than 180 days, consider exporting to a SIEM (Sentinel for Microsoft 365) or the Audit Premium add-on for the users who matter.