Audit report types: overview

The “Audit activities” for Microsoft 365 section offers a comprehensive report of all activities from the Unified Audit Log within your Microsoft 365 tenant. This report serves as an initial reference, which you can refine based on your specific investigation. For instance, you could generate a report detailing all actions undertaken by a particular user over the previous week. While only a subset of details for each event is displayed initially, you can access additional properties in the workload-specific reports.

In the Exchange section, you will find comprehensive reports on audited activities, admin and non-owner mailbox activities, Data Loss Prevention (DLP) actions, “Send As” or “Send on Behalf” activities, and changes to mailbox rights within your Microsoft 365 tenant.

In the SharePoint section, you will find detailed reports on various activities within your Microsoft 365 tenant. These include audited SharePoint Online activities, external and anonymous invitations, activities performed by external users, Site Collection administrator changes, sharing operations, and Site permission changes. Each category provides a curated view, with additional details available upon selecting the corresponding columns.

In the OneDrive section, you will find comprehensive reports on OneDrive for Business activities within your Microsoft 365 tenant. These include audited activities, external and anonymous invitations, activities performed by external users, Site Collection provisioning, Data Loss Prevention (DLP) activities, sharing operations, and Site permission changes. Each category offers a curated view, with the option to display additional details by selecting the corresponding columns.

The threat intelligence activities report a report of all Threat Intelligence audited activities within your Microsoft 365 tenant.

In the Teams section, you will find detailed reports on all Microsoft Teams activities within your Microsoft 365 tenant. These include audited activities, channel operations, membership operations, team management operations, external and anonymous invitations, activities performed by external users, Site Collection administrator changes, Data Loss Prevention (DLP) activities, sharing operations, and Site permission changes. Each category provides a curated view, with the option to display additional details by selecting the corresponding columns.

 The Power BI activities report provides a report of all Power BI audited activities within your Microsoft 365 tenant.

Here you are provided with a report of all Microsoft Purview and Microsoft Defender audited activities within your Microsoft 365 tenant.

The CRM activities page provides a report of all Dynamics CRM audited activities within your Microsoft 365 tenant.

In the Entra ID section, you will find comprehensive reports on all Entra ID activities within your Microsoft 365 tenant. These include audited activities, various sign-in events (overall, admin roles, external users, failed attempts), monthly sign-ins by user and app, risky users, risk detections, and sign-ins from anonymous IPs, unfamiliar locations, and using legacy protocols. For certain categories, additional details can be displayed by selecting the corresponding columns, and you have the option to display a map (Sign-in: events, with admin roles, external and failed) enable the anonymous data toggle (Sign-in: events, with admin roles, external and failed, from infected devices, from unfamiliar locations, risk detections and impossible to travel to atypical locations).
You may use this section to:

• Verify if a user has updated their password
• Check who changed a user license
• Check SharePoint site external access

Visit these pages to view the functionalities related to these audit reports only:

• Anonymous data toggle for Entra ID audit reports
• Show map feature in Entra ID audit reports

In the Power Apps section, you will find detailed reports on all Power Apps activities within your Microsoft 365 tenant. These include audited activities, creation, launch, and publishing events, as well as permission changes. Each category provides a comprehensive view, with the option to display additional details by selecting the corresponding columns.

The CoreView audit log is now located in the “Audit log” section under Settings. Here you'll find a record of all activities carried out in CoreView, enabling you to track and oversee the actions of each operator within CoreView.