Microsoft 365 Unified Audit Log
Search the Microsoft 365 rules.ID RecordType Workload Operations Samples Rules 1 Exchange admin activityExchange Exchange 78 71 31 8 Azure Active Directory / Entra ID eventsAzure Azure 64 62 26 2 Exchange mailbox activities (per-item)Exchange Exchange 14 8 11 98 Microsoft Defender for Cloud Apps alert eventsSecurity Security 10 0 10 6 SharePoint file operationsShare Share 18 16 7 25 Microsoft Teams activityMicrosoft Microsoft 10 8 5 14 SharePoint and OneDrive sharing operationsShare Share 13 12 4 3 Exchange mailbox group actionsExchange Exchange 4 4 3 15 Azure AD STS logon eventsAzure Azure 3 2 3 24 eDiscovery and Content Search activitySecurity Security 10 10 2 256 Power Platform administrator activityPower Platform Power Platform 83 3 2 40 Security & Compliance Center alert eventsSecurity Security 3 3 2 30 Power Automate activityPower Automate Power Automate 10 2 2 23 Skype for Business / Teams PowerShell cmdlet eventsMicrosoft Microsoft 2 0 2 4 SharePoint site and admin activityShare Share 7 7 1 47 Defender for Office 365 ATP content threat intelligenceThreat Threat 1 1 1 28 Defender for Office 365 threat intelligence eventsThreat Threat 1 1 1 13 DLP policy matches in ExchangeExchange Exchange 1 1 1 50 Exchange mailbox item operations (aggregated)Exchange Exchange 1 1 1 101 Exchange mailbox search activityExchange Exchange 1 1 1 57 Microsoft Teams admin activityMicrosoft Teams Microsoft Teams 1 1 1 102 SharePoint and OneDrive search activityShare Share 1 1 1 11 DLP policy matches in SharePointShare Share 1 0 1 51 Exchange Online Protection hygiene eventsExchange Exchange 1 0 1 45 Power Apps activityPower Apps Power Apps 29 0 1 18 Security & Compliance Center EOP cmdlet activitySecurity Security 45 45 0 38 Microsoft Purview data lifecycle activityMicrosoft Purview data lifecycle Microsoft Purview data lifecycle 6 6 0 52 Microsoft data-insights activityMicrosoft data-insights Microsoft data-insights 3 3 0 190 Microsoft Planner activityMicrosoft Planner Microsoft Planner 3 3 0 202 Microsoft To Do activityMicrosoft To Do Microsoft To Do 3 3 0 295 Microsoft Purview audit search activityMicrosoft Purview audit search Microsoft Purview audit search 2 2 0 157 Microsoft Information Protection activityMicrosoft Information Protection Microsoft Information Protection 1 1 0 188 Microsoft Planner activityMicrosoft Planner Microsoft Planner 1 1 0 89 AIR admin remediation action eventsSecurity Security 0 0 0 86 AIR manually triggered investigation eventsSecurity Security 0 0 0 64 Automated Investigation and Response (AIR) investigation eventsSecurity Security 0 0 0 294 Azure AD Identity Protection risk detectionsAzure Azure 0 0 0 285 Data lifecycle management events in ExchangeExchange Exchange 0 0 0 286 Data lifecycle management events in SharePointShare Share 0 0 0 21 Dataverse and model-driven apps auditDynamics 365 / Dataverse Dynamics 365 / Dataverse 10 0 0 34 Defender for Office 365 campaign eventsSecurity Security 0 0 0 62 Defender for Office 365 campaign eventsExchange Exchange 0 0 0 41 Defender for Office 365 URL threat intelligenceThreat Threat 0 0 0 107 DLP Exchange classification eventsExchange Exchange 0 0 0 33 DLP SharePoint classification eventsShare Share 0 0 0 63 Endpoint DLP policy eventsSecurity Security 0 0 0 65 Exchange Online Protection quarantine eventsExchange Exchange 0 0 0 58 HR connector signal eventsSecurity Security 0 0 0 61 Information worker protection eventsExchange Exchange 0 0 0 308 Insider Risk Management scoped user eventsSecurity Security 0 0 0 292 Insider Risk Management scoped user insightsSecurity Security 0 0 0 307 Microsoft Purview Insider Risk alertsSecurity Security 0 0 0 306 Microsoft Purview Insider Risk casesSecurity Security 0 0 0 90 Microsoft Threat Intelligence Center eventsSecurity Security 0 0 0 91 Physical badging signal eventsSecurity Security 0 0 0 46 Power Apps subscription plan eventsPower Apps Power Apps 0 0 0 186 Power Pages site activityPower Pages Power Pages 44 0 0 79 Power Platform connectors activityPower Platform Connectors Power Platform Connectors 15 0 0 187 Power Platform DLP activity (legacy)Power Platform Power Platform 15 0 0 42 Security & Compliance Center insights eventsSecurity Security 0 0 0 87 Security & Compliance Center RBAC eventsSecurity Security 0 0 0 106 Security & Compliance Center user change eventsSecurity Security 0 0 0 29 User mail submission / reporting eventsExchange Exchange 0 0 0