How to audit employees in SharePoint Online and Office 365

As your SharePoint Intranet and Office 365 grow in size and usage, I am sure you share the concern for security and integrity of your intellectual property. I am confident you did all the right things with security and training, but you can only do so much. You cannot really 100% prevent a rogue employee from doing damage by downloading a bunch of confidential files before they quit and join the competitor. And of course, you cannot prevent them from deleting your intellectual property (documents) from SharePoint. I recently had a client, an accountant, who hired some temporary help during a busy tax season, and he wanted to make sure the client data (tax returns, income statements, investments) does not “accidentally” leave his organisation with temporary employees.

Today I am going to talk about ways you can monitor your employees and see what they have been up to in SharePoint and Office 365. Luckily for you, there is a pretty robust reporting mechanism that exists in Office 365, that allows you to audit user behavior. The tool is simply called an Audit Log and is part of Security and Compliance offering, which offers much greater capabilities.

How to access Audit Logs

1. There are 2 ways you can access the Audit Logs. The easiest would be to click on Security & Compliance tile from the Office 365 App Launcher
2. You can also go to the following URL: https://protection.office.com
3. To access Audit Logs, navigate to Audit log search, under Search & investigation. You can also click on View Reports under it, gets you to the same thing

How to Enable Audit Log Reporting

Before you can access the reports, you have to enable the audit log. It might be a good idea to enable audit log reporting as soon as you start using SharePoint and Office 365, so you get as much history as possible. Once you enable the auditing, you will be to audit activities going forward (but not before the date you enabled them). To enable Audit Log Reporting, follow these steps:

1. Click Start recording user and admin activities
2. On the next screen, click Turn on
   
3. You will then see the message saying that the audit log is being prepared. Come back to this page several days later, once some activities have occurred in your SharePoint/Office 365 environment
   

How to run an Audit report

It is super simple. Just choose the Activities (criteria), Start and End dates for your search, type in the user name and hit Search

You will end up with results of the search in the right-hand-side of the screen

How to work with Audit Log data

Lots of reports

There are lots of reports for you to choose from. You can select lots of different SharePoint actions, like file deletions and downloads. You can track activities in Exchange (Outlook), PowerBI, Admin activities. In other words, the sky is the limit! And you can select multiple actions at the same time too!

Export data to Excel

You can also easily export data to Excel, so you can review it and organize it or just archive for your records.

Setup custom alerts

You can set up custom alerts, in a very similar fashion on how you set up regular SharePoint alerts. This way you will receive instant notifications when someone performs an action you have set up an alert for.