Microsoft 365 Unified Audit Log
Search the Microsoft 365 rules.ID RecordType Workload Operations Samples Rules 1 Exchange admin activityExchange Exchange 78 71 32 8 Azure Active Directory / Entra ID eventsAzure Azure 64 61 27 2 Exchange mailbox activities (per-item)Exchange Exchange 14 8 12 98 Microsoft Defender for Cloud Apps alert eventsSecurity Security 10 0 11 6 SharePoint file operationsShare Share 18 15 8 25 Microsoft Teams activityMicrosoft Microsoft 10 7 5 14 SharePoint and OneDrive sharing operationsShare Share 13 11 4 15 Azure AD STS logon eventsAzure Azure 3 2 4 3 Exchange mailbox group actionsExchange Exchange 4 4 3 256 Power Platform administrator activityPower Platform Power Platform 83 3 3 40 Security & Compliance Center alert eventsSecurity Security 3 3 3 30 Power Automate activityPower Automate Power Automate 10 2 3 24 eDiscovery and Content Search activitySecurity Security 10 10 2 47 Defender for Office 365 ATP content threat intelligenceThreat Threat 1 1 2 28 Defender for Office 365 threat intelligence eventsThreat Threat 1 1 2 13 DLP policy matches in ExchangeExchange Exchange 1 1 2 11 DLP policy matches in SharePointShare Share 1 0 2 51 Exchange Online Protection hygiene eventsExchange Exchange 1 0 2 45 Power Apps activityPower Apps Power Apps 29 0 2 23 Skype for Business / Teams PowerShell cmdlet eventsMicrosoft Microsoft 2 0 2 18 Security & Compliance Center EOP cmdlet activitySecurity Security 45 45 1 4 SharePoint site and admin activityShare Share 7 7 1 50 Exchange mailbox item operations (aggregated)Exchange Exchange 1 1 1 101 Exchange mailbox search activityExchange Exchange 1 1 1 57 Microsoft Teams admin activityMicrosoft Teams Microsoft Teams 1 1 1 102 SharePoint and OneDrive search activityShare Share 1 1 1 89 AIR admin remediation action eventsSecurity Security 0 0 1 86 AIR manually triggered investigation eventsSecurity Security 0 0 1 64 Automated Investigation and Response (AIR) investigation eventsSecurity Security 0 0 1 294 Azure AD Identity Protection risk detectionsAzure Azure 0 0 1 285 Data lifecycle management events in ExchangeExchange Exchange 0 0 1 286 Data lifecycle management events in SharePointShare Share 0 0 1 21 Dataverse and model-driven apps auditDynamics 365 / Dataverse Dynamics 365 / Dataverse 10 0 1 34 Defender for Office 365 campaign eventsSecurity Security 0 0 1 62 Defender for Office 365 campaign eventsExchange Exchange 0 0 1 41 Defender for Office 365 URL threat intelligenceThreat Threat 0 0 1 107 DLP Exchange classification eventsExchange Exchange 0 0 1 33 DLP SharePoint classification eventsShare Share 0 0 1 63 Endpoint DLP policy eventsSecurity Security 0 0 1 65 Exchange Online Protection quarantine eventsExchange Exchange 0 0 1 58 HR connector signal eventsSecurity Security 0 0 1 61 Information worker protection eventsExchange Exchange 0 0 1 308 Insider Risk Management scoped user eventsSecurity Security 0 0 1 292 Insider Risk Management scoped user insightsSecurity Security 0 0 1 307 Microsoft Purview Insider Risk alertsSecurity Security 0 0 1 306 Microsoft Purview Insider Risk casesSecurity Security 0 0 1 90 Microsoft Threat Intelligence Center eventsSecurity Security 0 0 1 91 Physical badging signal eventsSecurity Security 0 0 1 42 Security & Compliance Center insights eventsSecurity Security 0 0 1 87 Security & Compliance Center RBAC eventsSecurity Security 0 0 1 106 Security & Compliance Center user change eventsSecurity Security 0 0 1 29 User mail submission / reporting eventsExchange Exchange 0 0 1 38 Microsoft Purview data lifecycle activityMicrosoft Purview data lifecycle Microsoft Purview data lifecycle 6 6 0 52 Microsoft data-insights activityMicrosoft data-insights Microsoft data-insights 3 3 0 190 Microsoft Planner activityMicrosoft Planner Microsoft Planner 3 3 0 202 Microsoft To Do activityMicrosoft To Do Microsoft To Do 3 3 0 295 Microsoft Purview audit search activityMicrosoft Purview audit search Microsoft Purview audit search 2 2 0 157 Microsoft Information Protection activityMicrosoft Information Protection Microsoft Information Protection 1 1 0 188 Microsoft Planner activityMicrosoft Planner Microsoft Planner 1 1 0 46 Power Apps subscription plan eventsPower Apps Power Apps 0 0 0 186 Power Pages site activityPower Pages Power Pages 44 0 0 79 Power Platform connectors activityPower Platform Connectors Power Platform Connectors 15 0 0 187 Power Platform DLP activity (legacy)Power Platform Power Platform 15 0 0