Office 365 Auditing Report Tool - Office 365 Reports

Table of Contents

You can Download the tool by clicking here.
Supported Services:
Azure AD Audit Reports (76 reports):
User Logins (8 reports):
Password Changes (5 reports):
User Changes (12 reports):
Group Changes (8 reports):
Admin Role Changes (9 reports)
Application Changes (10 reports)
Directory Changes (5 reports):
Policy Changes (6 reports):
Administrative Unit Changes (5 reports):
Device Changes (8 reports):
Security Audit Reports (38 reports):
Risky Login Attempts (7 reports):
Users Added as Admins (25 reports):
External User Audit Report (6 reports):
Exchange Online Auditing Reports (66 reports):
Mailbox Access Activities (7 reports):
Mailbox Activities (4 reports):
Mailbox Management Activities (11 reports):
Mailbox Permission changes (5 reports):
Public Folder Changes(5 reports):
Advanced Threat Protection (10 reports):
Role Changes (6 reports):
Groups & Contacts Changes (6 reports):
Mail Flow Activities (7 reports):
Mobile Device Activities (3 reports):
Exchange DLP Activities (2 reports):
Email Audit Reports (66 reports):
Email Activities (5 reports):
Spam Mails (3 reports):
Phish Mails (3 reports):
Spoof Mails (2 reports):
Malware Mails (3 reports):
Transport Rule and DLP Hits (2 reports):
Overall Email Statistics (3 reports):
User’s Email Statistics (4 reports):
User’s Mail Traffic Statistics (4 reports):
Inactive Users (3 reports):
Top Email Statistics (10 reports):
Overall Threat Protection Statistics (6 reports):
Threat Protection Statistics by Spam Detection (4 reports):
Threat Protection Statistics by Phish Detection (8 reports):
Threat Protection Statistics by Malware Detection (6 reports):
SharePoint Online Auditing Reports (130 reports):
Site Collection Changes (5 reports):
Site Collection Configuration (7 reports):
SharePoint Service (2 reports):
SharePoint Policies (4 reports):
Groups Changes (7 reports):
Access Requests Activities (6 reports):
Sharing Invitations Activities (8 reports):
Company Links Changes (4 reports):
Anonymous Links Changes (5 reports):
Secure Links Changes (6 reports):
User Share Activities (3 reports):
File Access Activities (3 reports):
File Management Activities (7 reports):
File Deletion and Restore Activities (4 reports):
File Change Activities (11 reports):
All Admin Activities (7 reports):
Folder Changes (8 reports):
Folder Deletion and Restoration (5 reports):
Page Changes (7 reports):
SharePoint DLP Activities (4 reports):
SharePoint Sensitivity Label Activities (6 reports):
SharePoint Site Permission Changes (5 reports):
SharePoint Hub Site Changes (6 reports):
OneDrive Audit Reports (77 reports):
Administrative Change (5 reports):
Other Site Activities (1 report):
Company Links (5 reports):
Anonymous Links (5 reports):
Secure Links (6 reports):
User Shares (3 reports):
Sharing Invitations (6 reports):
File Access Changes (3 reports):
File Management Changes (5 reports):
File Deletion and Restore (4 reports):
File Change Activities (9 reports):
Folder Activities (11 reports):
Page Activities (2 reports):
OneDrive DLP Actions (4 reports):
Sensitivity Label Activities (3 reports):
OneDrive Site Permissions (5 reports):
Security and Compliance Audit Reports (45 reports):
Threat Policy (3 reports):
Mail Security Policy (4 reports):
Security and Alert Policy (5 reports):
eDiscovery Changes (6 reports):
Audit Activities and Permissions (4 reports):
Information Protection (3 reports):
Data Loss Prevention (6 reports):
Records Management (5 reports):
Device Configurations (3 reports):
Retention and Risk Analysis (6 reports):
OneNote Audit Activities (6 reports):
OneNote Activities (4 reports):
OneNote Section Activities (2 reports):
Power BI Auditing Reports (38 reports):
General Power BI Reports (9 reports):
Activities on Power BI Dashboards (8 reports)
Activities on Power BI Reports (9 reports)
Activities on Power BI Datasets (5 reports):
Activities on Power BI Dataflows (7 reports):
Teams Auditing Reports (32 reports):
Login and Settings Changes (3 reports):
Teams & Channel Management Activities (4 reports):
Teams File Transfers: (4 reports)
AddOn Management (4 reports):
Teams Apps Management (2 reports):
Teams Member Changes Reports (6 reports):
Private Channel Member Changes Reports (6 reports):
Teams DLP Actions (3 reports):
Stream Audit Reports (41 reports):
Teams Recording Events (4 reports):
Live Events (4 reports):
Video Events (10 reports):
Video Engagement Events (6 reports):
Video Text Track Events (4 reports):
Channel Events (5 reports):
Group Events (6 reports):
Settings based Events (2 reports):
Office 365 Activity Alerts Reports (111 reports):
Overall Alerts (2 reports):
Daily Summary (3 reports):
All User Summary (8 reports)
External User Summary (8 reports):
General Activities (12 reports):
File and Folder Alerts (12 reports):
File Sharing Alerts (12 reports):
Site Administration Alerts (22 reports)
Site Synchronization Alerts (6 reports):
External Users (4 reports):
Daily Summary (2 reports):
Trigger Summary (7 reports):
Alert Severity (4 reports):
Alert Category (6 reports):
Policy Type (3 reports):
Office 365 Secure Score Reports (34 reports):
Overall Secure Score (5 reports):
MFA Score (2 reports):
MDM Score (13 reports):
Azure AD Score (10 reports):
General Settings (1 report):
Average Comparative Scores (3 reports):
General Auditing (27 reports):
Overall Activities (9 reports):
O365 Workload Based Activities (9 reports):
General (3 reports):
Anonymous Sharing Activities (3 reports):
External Sharing Activities (3 reports):
Office 365 Auditing Tool – Dashboards:
Reporting Capabilities Highlights:
AdminDroid Office 365 Auditing Tool – Release History:

This Office 365 auditing tool helps the administrators to visualize the activities happen inside their Office 365 environment in a clear way.

This tool provides more than 850+ out-of-the-box Office 365 auditing reports, which are widely sought after by several Office 365 administrators. These reports provide rich information that is required to monitor user activities, file and shared items efficiently.

The auditing dashboards show the summarized activities performed on Office 365 application such as Azure AD, Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Power BI and Security & Compliance Center.

Using this powerful Microsoft 365 auditing tool, IT administrators will not only be able to extract rich Office 365 auditing reports and statistics but can also schedule the reports and have them emailed at selected intervals.

Each report provides AI-powered graphical analysis to gain insights and better understand the data in a visually appealing manner. Additionally, AdminDroid offers 30+ Office 365 dashboards in which you can get statistics about your Office 365 environment very easily.

AdminDroid’s Free Microsoft 365 auditing tool provides 75+ free audit reports on users login activities, password changes, group membership changes, admin role changes, user & group modifications, application & device operations, and many more.

PS: Attached the screenshot of Dashboards at the end of this post.

You can Download the tool by clicking here.

Supported Services:

Azure Active Directory (76 reports)
Security Audit Reports (38 reports)
Exchange Online Auditing (66 reports)
Email Audit Reports (66 reports)
SharePoint Online Auditing (130 reports)
OneDrive Business Auditing (77 reports)
Security and Compliance Auditing (45 reports)
OneNote Audit Activities (6 repots)
Power BI Auditing (38 reports)
Teams Auditing (32 reports)
Stream Auditing (41 reports)
Office 365 Activity Alerts Reports (111 reports)
Office 365 Secure Score Reports (34 Reports)
General Auditing (27 reports)

Azure AD Audit Reports (76 reports):

User Logins (8 reports):

All User Logins
Successful User Logins
Failed User Logins
User’s Last Logon Time
User’s First Logon Time of a Day
User’s Daily Login Count Summary
User’s Monthly Login Count Summary
User’s Daily Login Failure Count Summary

Password Changes (5 reports):

Password Reset by Admin
User Password Changes
Admin Configured a Setting to Force Change User Password
Self Service Password Resets
All Password Changes

User Changes (12 reports):

Created Users
Updated Users
Audit Deleted Users
Audit Sign-in Re-Enabled Users
Audit Sign-in Disabled Users
License Changes
License Assignment Activities
License Revoking Activities
Group Based License Changes
MFA (Multi-factor Authentication) Enabled
MFA (Multi-factor Authentication) Disabled
All User Administrative Events

Group Changes (8 reports):

Created Groups
Updated Groups
Audit Deleted Groups
Group Settings Changes
Group License Changes
Group Member Changes
Group Owner Changes
Group Administration

Admin Role Changes (9 reports)

User Added to Admin Role
User Removed from Admin Role
Role Member Changes
Role Assignments
Directory Role Changes
Added Directory Roles
Updated Directory Roles
Deleted Directory Roles
All Role Operations

Application Changes (10 reports)

Added Applications
Updated Applications
Deleted Applications
Consent to Applications
OAuth2 Permission Grant
App Role Assignments
Service Principal Changes
Credential Changes
Delegation Changes
All App Operations

Directory Changes (5 reports):

Domain Changes
Company Information
Directory Settings Changes
Partner Record
All Directory Operations

Policy Changes (6 reports):

Added Policies
Updated Policies
Deleted Policies
Default Policy Assignments
Policy Credential Removals
All Policy Operations

Administrative Unit Changes (5 reports):

Added AUs
Updated AUs
Deleted AUs
AUs Member Changes
All AU Operations

Device Changes (8 reports):

Added Devices
Updated Devices
Deleted Devices
Device Configuration Changes
Device Owner Changes
Device User Changes
Device Credential Changes
All Device Operations

Security Audit Reports (38 reports):

Users Failed to Pass the MFA Challenge
Users Tried to Login with Expired Passwords
Disabled Users Login Attempts
All Admins Login Activities
All External and Internal Guest User Logins
Admins Login Failures
Admins Daily Login Failure Summary

Users Added as Admins (25 reports):

Users Added to Global Administrator Role
Users Added to Global Reader Role
Users Added to Exchange Administrator Role
Users Added to SharePoint Administrator Role
Users Added to Teams Service Administrator Role
Users Added to Kaizala Administrator Role
Users Added to Skype Administrator Role
Users Added to PowerBI Administrator Role
User Added to Azure DevOps Authentication Administrator Role
User Added to Azure Information Protection Administrator Role
Users Added to Privileged Authentication Administrator Role
Users Added to Compliance Administrator Role
Users Added to Compliance Data Administrator Role
Users Added to Search Administrator Role
Users Added to Helpdesk Administrator Role
Users Added to Billing Administrator Role
Users Added to Service Administrator Role
Users Added to Printer Administrator Role
Users Added to Office Apps Administrator Role
Users Added to User Management Administrator Role
User Added to Password Administrator Role
User Added to External Identity Provider Administrator Role
User Added to Group Administrator Role
Users Added to Authentication Administrator Role
Users Added to License Administrator Role

External User Audit Report (6 reports):

Created External Users
Updated External Users
External User’s Licenses/Plans Assignments
Disabled Plans for the External Users
Audit Deleted External Users
External Members Added/Removed from Groups

Exchange Online Auditing Reports (66 reports):

Mailbox Access Activities (7 reports):

Mailbox Owner Access
Mailbox Non-Owner Access
Mailboxes Accessed by Admins
Mailboxes Accessed by Guest Users
User’s Mailbox Logins
Mailbox PowerShell Logins
Mailbox Searches

Mailbox Activities (4 reports):

Operations on Mail (Delete, Move, Copy…)
Bulk Operations on Mails (Delete, Move, Copy…)
Mailbox Item Creations
Binded Folders

Mailbox Management Activities (11 reports):

Added Mailbox
Updated Mailbox
Removed Mailbox
Mailbox Enable/Disable Activities
Mailbox Restore Activities
Mailbox Configuration Changes
Outlook Apps
Inbox Features
Inbox Rule Changes
Create or Update Inbox Rules
All Mailbox Operations

Mailbox Permission changes (5 reports):

Mailbox Permission Changes
Mailbox Folder Changes
SendAs Permission Changes
Public Folder Permission Changes
Folder Permissions

Public Folder Changes(5 reports):

Recently Added Public Folders
Recently Updated Public Folders
Recently Removed Public Folders
Activities on Mail Public Folders
All Activities on Public Folders

Advanced Threat Protection (10 reports):

Safe Attachments Config Changes
Safe Attachments Config Changes
Safe Link Config Changes
Anti-Spam Config Changes
Anti-Malware Config Changes
Phishing Filter Config Changes
Anti-Phish Policy/Rule Config Changes
Junk Email Config Changes
DKIM Config Changes
Advanced Threat Protection (ATP) Policy Config Changes
All Advanced Threat Protection (ATP) Activities

Role Changes (6 reports):

Management Role Changes
Role Assignments Changes
Role Assignments Policy Changes
Role Entry Changes
Role Group Changes
Exchange Management Role Scope Changes

Groups & Contacts Changes (6 reports):

Office 365 Group Changes
Distribution Group Changes
Dynamic Distribution Group Changes
All Group Changes
Mail Contact Changes
Mail User Changes

Mail Flow Activities (7 reports):

Mail Flow Configuration Changes
Transport Rule Changes
Connector Changes
Accepted Domain Configuration
Remote Domain Configuration
Hybrid Configuration Changes
Federation Configuration Changes

Mobile Device Activities (3 reports):

Mobile Device Configuration Changes
Exchange ActiveSync Configuration Changes
Text Message Settings Changes

Exchange DLP Activities (2 reports):

DLP Rule Detected Mails
Data Loss Prevention Configuration Changes

Email Audit Reports (66 reports):

Email Activities (5 reports):

All Mails
All Undelivered Emails
Users Mail ‘Send’ Activities
User’s Send as Activities
User’s Send on Behalf Activities

Spam Mails (3 reports):

Incoming External Spam Mails
Outgoing External Spam Mails
Internal Spam Mails

Phish Mails (3 reports):

Incoming External Phish Mails
Outgoing External Phish Mails
Internal Phish Mails

Spoof Mails (2 reports):

External Spoof Mails
Internal Spoof Mails

Malware Mails (3 reports):

Incoming Malware Phish Mails
Outgoing Malware Phish Mails
Internal Malware Mails

Transport Rule and DLP Hits (2 reports):

Transport Rule Messages
DLP Policy Messages

Overall Email Statistics (3 reports):

Daily Overall User Email Traffic
Organization’s Daily Mail Flow Status Summary
Organization’s Daily Mail Traffic Summary

User’s Email Statistics (4 reports):

Daily Mail Read/Sent/Received Count by Users
Mail Statistics (Read/Sent/Received) Summary of User Mailboxes
Daily Exchange Active User Count by Activity
Daily Mail Traffic Summary by Users

User’s Mail Traffic Statistics (4 reports):

Daily Mails Sent/Received by Users
Daily Spam Mails Sent/Received by Users
Daily Phish Mails Sent/Received by Users
Daily Malware Mails Sent/Received by Users

Inactive Users (3 reports):

Inactive Exchange Users by Last Mail Read Date
Inactive Exchange Users by Last Mail Sent Date
Inactive Exchange Users by Last Mail Received Date

Top Email Statistics (10 reports):

Top Mail Senders
Top Mail Receivers
Top Spam Senders
Top Spam Receivers
Top Phish Senders
Top Phish Receivers
Top Spoof Senders
Top Malware Senders
Top Malware Receivers
Top Malwares

Overall Threat Protection Statistics (6 reports):

Organization’s Daily Threat Protection Stats
Overall Threat Protection Stats by Non-Spam Mails Passed
Overall Threat Protection Stats by Spam Detections
Overall Threat Protection Stats by Phish Detections
Overall Threat Protection Stats by Spoof Detections
Overall Threat Protection Stats by Malware Detections

Threat Protection Statistics by Spam Detection (4 reports):

Reputation Spam Detections
Bulk Spam Detections
Filtered Spam Detections
Other Spam Detections

Threat Protection Statistics by Phish Detection (8 reports):

Spoofing Phish Detections
Filtered Phish Detections
Impersonation Phish Detections
Reputation Phish Detections
Detonation Phish Detections
Phish File Detections
Phish URL Detections
Other Phish Detections

Threat Protection Statistics by Malware Detection (6 reports):

Malware Engine Detections
Detonation Malware Detections
Reputation Malware Detections
Malware File Detections
Malware URL Detections
Campaign Malware Detections

SharePoint Online Auditing Reports (130 reports):

Site Collection Changes (5 reports):

Site Collections Created
Sites Collections Deleted
Site Collection Admin Added
Site Collection Admin Removed
Site Collection Admin Change Request

Site Collection Configuration (7 reports):

Site Collections Renamed
Sites Collections Swapped
Site Collection Quota Modified
Site Collection Removed Users/Groups
Member’s Sharing Permission Setting Changes
Disable Sharing Permission for Non-Owners Using Script
Site Sharing Report Creation

SharePoint Service (2 reports):

Sign In Event
Search Query Performed

SharePoint Policies (4 reports):

SharePoint Changed at Site Level
Sharing Policy Changed at Tenant Level
Device Access Policy Changed at Tenant Level
Network Access Policy Changed at Tenant Level

Groups Changes (7 reports):

Created SharePoint Groups
Updated SharePoint Groups
Deleted SharePoint Groups
Member Added in SharePoint Groups
Member Removed from SharePoint Groups
External User Added in SharePoint Groups
External User Removed from SharePoint Groups

Access Requests Activities (6 reports):

Created Access Requests
Accepted Access Requests
Denied Access Requests
Updated Access Requests
Access Request Settings Modified
All Access Request Events

Created Sharing Invitations
Accepted Sharing Invitations
Revoked Sharing Invitations
Blocked Sharing Invitations
Updated Sharing Invitations
Changed Guest User Expiration for Sharing Invitations
Invitations Shared to External Users
All Events Related to Sharing Invitations

Company Links Changes (4 reports):

Created Company Links in SharePoint
Removed Company Links in SharePoint
SharePoint Resources Accessed Using Company Links
All SharePoint Events Related to Company Links

Anonymous Links Changes (5 reports):

Created Anonymous Links in SharePoint
Removed Anonymous Links in SharePoint
Updated Anonymous Links in SharePoint
SharePoint Resources Accessed Using Anonymous Links
All SharePoint Events Related to Anonymous Links

Secure Links Changes (6 reports):

Created Secure Links in SharePoint
Used Secure Links in SharePoint
Deleted Secure Links in SharePoint
Updated Secure Links in SharePoint
Users Added to Secure Links
Users Removed from Secure Links

User Shared Files, Folders or Site in SharePoint
User Unshared Files, Folder or Site in SharePoint
Shared Office Web App Document in SharePoint

File Access Activities (3 reports):

Accessed SharePoint Files
SharePoint File Access Extended
Previewed SharePoint Files

File Management Activities (7 reports):

Uploaded SharePoint Files
Copied SharePoint Files
SharePoint Files Copied Across SharePoint Sites
Moved SharePoint Files
SharePoint Files Moved Across SharePoint Sites
Renamed SharePoint Files
Downloaded SharePoint Files

File Deletion and Restore Activities (4 reports):

SharePoint File Deleted by User
SharePoint File Deleted from First Stage Recycle Bin
SharePoint File Deleted from Second Stage Recycle Bin
Restored SharePoint Files

File Change Activities (11 reports):

Modified SharePoint Files
Checked In SharePoint Files
Checked Out SharePoint Files
Check Out Discarded for SharePoint Files
SharePoint File Modification Extended
Recycled a SharePoint File Version
Recycled All Minor Versions of a File in SharePoint
Recycled All Versions of a File in SharePoint
Malware Detected for a File
Applied/Removed Retention Label from a File
All Activities Related to SharePoint Files

All Admin Activities (7 reports):

SharePoint Files Accessed by Admins
SharePoint Files Previewed by Admins
SharePoint Files Downloaded by Admins
SharePoint File Deleted Permanently by Script
Deleted a SharePoint File Version Permanently by Script
SharePoint Document Library Activities
All SharePoint File Activities Performed by Admins

Folder Changes (8 reports):

Created SharePoint Folders
Modified SharePoint Folders
Renamed SharePoint Folders
Moved SharePoint Folders
SharePoint Folders Moved Across SharePoint Sites
Copied SharePoint Folders
SharePoint Folders Copied Across SharePoint Sites
All Activities Related to SharePoint Folders

Folder Deletion and Restoration (5 reports):

SharePoint Folder Deleted Permanently by Script
SharePoint Folder Deleted by User
SharePoint Folder Deleted from First Stage Recycle Bin
SharePoint Folder Deleted from Second Stage Recycle Bin
Restored SharePoint Folders

Page Changes (7 reports):

Viewed SharePoint Pages
SharePoint Page Viewing Extended
Prefetched SharePoint Pages
External User Activities Related to SharePoint Pages
View Signaled by Client for Pages
All SharePoint Page Comments Related Activities
All Activities Related to SharePoint Pages

SharePoint DLP Activities (4 reports):

SharePoint DLP Rule Matches
SharePoint DLP Rule Detection
SharePoint DLP Rule Undo
All SharePoint DLP Actions

SharePoint Sensitivity Label Activities (6 reports):

Sensitivity Label Applied for SharePoint Files
Sensitivity Label Changed for SharePoint Files
Sensitivity Label Removed for SharePoint Files
Sensitivity Label Applied for SharePoint Site
Sensitivity Label Changed for SharePoint Site
Sensitivity Label Removed for SharePoint Site

SharePoint Site Permission Changes (5 reports):

New Permission Level Added to Site Collection for SharePoint
Deleted Permission Level from Site Collection for SharePoint
Modified Permission Level Properties on a Site Collection for SharePoint
Broke Sharing Inheritance for an Item in SharePoint
Deleted Unique Permissions for an Item in SharePoint

SharePoint Hub Site Changes (6 reports):

Registered a Hub Site
Unregistered a Hub Site
Joined a Site to a Hub Site
Joined a Site to a Hub Site
Enabled Permission Sync for a Hub Site
Disabled Permission Sync for a Hub Site

OneDrive Audit Reports (77 reports):

Administrative Change (5 reports):

OneDrive Site Collection Admin Added
OneDrive Site Collection Admin Removed
Site Collection Quota Modified for OneDrive
Removed User/Group from Site Collection
Performed Search Query in OneDrive

Other Site Activities (1 report):

Added Shortcut to an Item

Company Links (5 reports):

Created Company Links in OneDrive
Removed Company Links in OneDrive
OneDrive Resources Accessed Using Company Links
OneDrive Resources Accessed Using Company Links
All OneDrive Events Related to Company Links

Anonymous Links (5 reports):

Created Anonymous Links in OneDrive
Removed Anonymous Links in OneDrive
Updated Anonymous Links in OneDrive
OneDrive Resources Accessed Using Anonymous Links
All OneDrive Events Related to Anonymous Links

Secure Links (6 reports):

Secure Link Created for a OneDrive Item
Secure Link Used to Access a OneDrive Item
Secure Link Deleted for a OneDrive Item
Secure Link Updated for a OneDrive Item
Added to Secure Link for Accessing a OneDrive Item
Removed from Secure Link that Gives Access to a OneDrive Item

User Shares (3 reports):

User Shared Files or Folders in OneDrive
User Unshared Files or Folder in OneDrive
Shared Office Web App Document in OneDrive

Created Sharing Invitations for OneDrive
Accepted Sharing Invitations for OneDrive
Revoked Sharing Invitations for OneDrive
Blocked Sharing Invitations for OneDrive
Updated Sharing Invitations for OneDrive
Guest User Expiration Changed for OneDrive

File Access Changes (3 reports):

Accessed OneDrive Files
OneDrive File Access Extended
Previewed OneDrive Files

File Management Changes (5 reports):

Uploaded OneDrive Files
Copied OneDrive Files
Moved OneDrive Files
Renamed OneDrive Files
Downloaded OneDrive Files

File Deletion and Restore (4 reports):

OneDrive File Deleted by User
OneDrive File Deleted from First Stage Recycle Bin
OneDrive File Deleted from Second Stage Recycle Bin
Restored OneDrive Files

File Change Activities (9 reports):

Modified OneDrive Files
OneDrive File Modification Extended
Removed an Item From Shared With You
Checked In OneDrive Files
Checked Out OneDrive Files
Check Out Discarded for OneDrive Files
Recycled All Versions of a File in OneDrive
Recycled a OneDrive File Version
All Activities Related to OneDrive Files

Folder Activities (11 reports):

Created OneDrive Folders
Modified OneDrive Folders
Renamed OneDrive Folders
Moved OneDrive Folders
Copied OneDrive Folders
OneDrive Folder Deleted by User
Recycled All Versions of a File in OneDrive
OneDrive Folder Deleted from First Stage Recycle Bin
OneDrive Folder Deleted from Second Stage Recycle Bin
Restored OneDrive Folders
All Activities Related to OneDrive Folders

Page Activities (2 reports):

Viewed OneDrive Pages
OneDrive Page Viewing Extended

OneDrive DLP Actions (4 reports):

OneDrive DLP Rule Matches
OneDrive DLP Rule Undo
OneDrive DLP Rule Detection
All OneDrive DLP Actions

Sensitivity Label Activities (3 reports):

File Sensitivity Label Applied for OneDrive
File Sensitivity Label Changed for OneDrive
File Sensitivity Label Removed for OneDrive

OneDrive Site Permissions (5 reports):

New Permission Level Added to Site Collection for OneDrive
Deleted Permission Level from Site Collection for OneDrive
Modified Permission Level Properties on a Site Collection for OneDrive
Broke Sharing Inheritance for an Item in OneDrive
Deleted Unique Permissions for an Item in OneDrive

Security and Compliance Audit Reports (45 reports):

Threat Policy (3 reports):

Phishing Simulation Override Policies and Rules
Spam Content Filter Policies and Rules
SecOps Mailbox Overrides Policies and Rules

Mail Security Policy (4 reports):

Quarantining of Spam, Phishing and Malware Mails
Mail Flow Status Report
Inbound Connector
Outbound Connector

Security and Alert Policy (5 reports):

Malicious Links Protection Filter
Malicious Links Protection Filter
Activity Alert Configurations
Threat Detection Alerts
Threat Detection Alerts

eDiscovery Changes (6 reports):

eDiscovery Cases
Search Permissions Filter Changes
eDiscovery Legal Holds
eDiscovery Case Membership Changes
eDiscovery Case Admin Changes
All Compliance Search Activities Performed by Admins

Audit Activities and Permissions (4 reports):

Unified Audit Log Retention Policy Changes
Audit Configuration Policy Changes
Office 365 Audit Log Disabling & Enabling Activities
Assigning Roles to Bulk Users

Information Protection (3 reports):

Auto-labeling Policies Management
DLP Policy Messages

Data Loss Prevention (6 reports):

Data Loss Prevention Policies and Rules
Exact Data Match Schema Policies and Rules
DLP Sensitive Information Type Rules
Review DLP Detection Reports
Endpoint Restriction Settings
Configuration of Policy Tips

Records Management (5 reports):

Compliance Retention Events
Compliance Retention Event Type
Retention Labels
Adaptive Scope Management
File Plan Management

Device Configurations (3 reports):

Device Conditional Access Policies Management
Device Configuration Policies Management
Device Tenant Policies Management

Retention and Risk Analysis (6 reports):

Compliance Retention Configurations
App Retention Compliance Configurations
Insider Risk Policies Management
Organization Segments
Communication Compliance Policies Management
Privacy Management Configurations

OneNote Audit Activities (6 reports):

OneNote Activities (4 reports):

Created Notes
Accessed Notes
Uploaded Notes
Modified Notes

OneNote Section Activities (2 reports):

Section Accessed
Section Modified

Power BI Auditing Reports (38 reports):

General Power BI Reports (9 reports):

Power BI Management Actions
Sharing Activities on Power BI Dashboards and Reports
Viewing Activities on Power BI Dashboards, Reports and Usage Metrics
Opt-In for Power BI Pro Trial
Activities on Power BI Dashboards
Activities on Power BI Reports
Activities on Power BI Apps
Activities on Power BI Datasets
Activities on PowerBI Dataflows

Activities on Power BI Dashboards (8 reports)

Recently Created Power BI Dashboards
Recently Deleted Power BI Dashboards
Recently Edited Power BI Dashboards
Recently Viewed Power BI Dashboards
Recently Shared Power BI Dashboards
Recently Printed Power BI Dashboards
Recently Exported Power BI Dashboards
Recently Exported Power BI Tile

Activities on Power BI Reports (9 reports)

Recently Created Power BI Reports
Recently Deleted Power BI Reports
Recently Edited Power BI Reports
Recently Viewed Power BI Reports
Recently Published Power BI Reports
Recently Shared Power BI Reports
Recently Printed Power BI Reports
Recently Exported Power BI Reports
Recently Downloaded Power BI Reports

Activities on Power BI Datasets (5 reports):

Recently Created Power BI Datasets
Recently Deleted Power BI Datasets
Recently Edited Power BI Datasets
Power BI Dataset Refresh Requested
Power BI Dataset Refresh Setup

Activities on Power BI Dataflows (7 reports):

Recently Created Power BI Dataflows
Recently Updated Power BI Dataflows
Recently Viewed Power BI Dataflows
Recently Exported Power BI Dataflows
Power BI Dataflow Refresh Requested
Power BI Dataflow Refresh Setup
Power BI Dataflow Refresh Cancelled

Teams Auditing Reports (32 reports):

Teams Login Activities
Teams Settings Changes
Teams External Users Login Activities

Teams & Channel Management Activities (4 reports):

Teams Activities
Channel Activities
Private Channels Created in Teams
All Ownership Promotion and Demotion Activities in Teams

Teams File Transfers: (4 reports)

Files Shared via Teams Channels
Files Shared via Private Chat
Files Shared by External Users in Channels
Files Shared to External Users in Private Chat

AddOn Management (4 reports):

All AddOn Activities
Activities on Bot
Activities on Connector
Activities on Tab

Teams Apps Management (2 reports):

Recently Installed Apps in Teams
Recently Uninstalled Apps in Teams

Teams Member Changes Reports (6 reports):

Members Added in Teams
Members Removed in Teams
Owner Added to Teams
Owner Removed from Teams
Ownership Promoted in Teams
Ownership Demoted in Teams

Private Channel Member Changes Reports (6 reports):

Members Added in Private Channels
Members Removed in Private Channels
Owner Added to Private Channels
Owner Removed from Private Channels
Ownership Promoted in Private Channels
Ownership Demoted in Private Channels

Teams DLP Actions (3 reports):

Teams DLP Rule Matches
Teams DLP Rule Undo
Teams DLP Info

Stream Audit Reports (41 reports):

Teams Recording Events (4 reports):

Teams Call and Meeting Recordings Created in Stream
Teams Call and Meeting Recordings Uploaded in Stream
Teams Meeting Record Shared to Owners
Teams Meeting Record Shared to Viewers

Live Events (4 reports):

Stream Live Events Broadcasted
Stream Live Events Started Ingesting
Stream Live Events Stopped Ingesting
All Stream Live Event Operations

Video Events (10 reports):

Stream Videos Created
Stream Videos Modified
Stream Videos Uploaded
Stream Videos Deleted
Stream Videos Deleted from RecycleBin
Stream Videos Restored
Stream Meeting Sharing Link Created
Stream Videos Thumbnail Uploaded
Stream Videos Trimmed
All Stream Videos Operations

Video Engagement Events (6 reports):

Stream Videos Viewed
Stream Video Shared
Stream Videos Downloaded
Stream Videos Like actions
Stream Videos Comment actions
All Engagement Events

Video Text Track Events (4 reports):

Stream Text Track Uploaded
Stream Text Track Modified
Stream Text Track Deleted
All Stream Text Track Operations

Channel Events (5 reports):

Stream Channel Created
Stream Channel Modified
Stream Thumbnail Uploaded
Stream Channel Deleted
All Stream Channel Operations

Group Events (6 reports):

Stream Group Created
Stream Group Modified
Stream Group Deleted
Stream Admin Role Changes
Stream Member Role Changes
All Stream Groups Operations

Settings based Events (2 reports):

Stream Tenant Setting Changes
Stream User Setting Changes

Office 365 Activity Alerts Reports (111 reports):

Overall Alerts (2 reports):

All Alerts on User Activities
All Triggered Alert Policies

Daily Summary (3 reports):

Daily Summary of User Alerts
Daily Summary of User Alerts by Activity
Daily Summary of User Alerts by Activity Type

All User Summary (8 reports)

Alerts Summary by Users
User Alerts Summary by Activity
User Alerts Summary by Activity Type
User Alerts Summary by Policy Name
User Alerts Summary by Severity Status
User Alerts Summary by Category
User Alerts Summary by Creation Type
User Alerts Summary by System Policy

External User Summary (8 reports):

Alerts Summary by External Users
External User Alerts Summary by Activity
External User Alerts Summary by Activity Type
External User Alerts Summary by Policy Name
External User Alerts Summary by Severity Status
External User Alerts Summary by Category
External User Alerts Summary by Policy Type
External User Alerts Summary by System Policy

General Activities (12 reports):

Alerts on Mail Forward/Redirection Rule Creation
Alerts on External File Sharing
Alerts on External User File Activity
Alerts on DLP Policy Match
Alerts on eDiscovery Search/Export
Alerts on Mailbox Permission Granting
Alerts on Exchange Admin Permission Granting
Alerts on User Reported an Email
Alerts on Malware Detection in File
Alerts on File/Folder Sharing
Alerts on File/Folder Activity
Alerts on File/Folder Changes

File and Folder Alerts (12 reports):

Alerts on File Access
Alerts on File Deletion
Alerts on File Downloading
Alerts on File Copying
Alerts on File Modification
Alerts on Moving File
Alerts on Renaming File
Alerts on Restoring File
Alerts on File Check-in
Alerts on File Check-out
Alerts on File Check-out Discarding
Alerts on File Uploading

Alerts on File/Folder/Site Sharing
Alerts on Sharing Invitation Creation
Alerts on Sharing Invitation Acceptance
Alerts on Access Request Creation
Alerts on Access Request Acceptance
Alerts on Access Request Denial
Alerts on Company Shareable Link Creation
Alerts on Company Shareable Link Removal
Alerts on Anonymous Link Creation
Alerts on Anonymous Link Usage
Alerts on Anonymous Link Update
Alerts on Anonymous Link Removal

Site Administration Alerts (22 reports)

Alerts on User-Agent Additions in the SharePoint Admin Center
Alerts on User Agents Changes in the SharePoint Admin Center
Alerts on Enabling Document Preview for a Site
Alerts on Enabling Legacy Workflow for a Site
Alerts on Enabling Office on Demand for a Site
Alerts on Enabling RSS Feeds for a Site
Alerts on Site Collection Creation
Alerts on New Site Collection Admin
Alerts on Site Admin Permission Requests
Alerts on Changing a Sharing Policy for SharePoint
Alerts on Updating People Search Source for a Site
Alerts on Setting Host Site for OneDrive
Alerts on Renaming SharePoint Site
Alerts on Granting Users for Group Creation
Alerts on Sent to Connection Creation in SharePoint
Alerts on Sent to Connection Deletion in SharePoint
Alerts on New of User/Group in SharePoint
Alerts on SharePoint Group Creation
Alerts on SharePoint Group Deletion
Alerts on SharePoint Group Setting Changes
Alerts on Group Permission Modification for a Site
Alerts on Group Member Removal in SharePoint Group

Site Synchronization Alerts (6 reports):

Alerts on User Establishes Site to Computer Sync
Alerts on User Blocked to Sync a Site to Computer
Alerts on Downloading a File by Syncing
Alerts on Downloading File Changes by Syncing
Alerts on Uploading a File by Syncing
Alerts on Uploading File Changes by Syncing

External Users (4 reports):

Alerts on All External User Activities
Alerts on External User Common Activities
Alerts on External User File and Folder Activities
Alerts on External User File Sharing Activities

Daily Summary (2 reports):

Daily Summary of Alerts by Activity
Daily Summary of Alerts by Activity Type

Trigger Summary (7 reports):

Overall Alerts Summary by Activity
Overall Alerts Summary by Activity Type
Overall Alerts Summary by Policy Name
Overall Alerts Summary by Severity Status
Overall Alerts Summary by Category
Overall Alerts Summary by Creation Type
Overall Alerts Summary by System Policy

Alert Severity (4 reports):

Alerts on High Severity
Alerts on Medium Severity
Alerts on Low Severity
Alerts on Informational Events

Alert Category (6 reports):

Alerts on Data Loss Prevention
Alerts on Threat Management
Alerts on Data Governance
Alerts on Permissions
Alerts on Mail Flow
Alerts on Uncategorized Activities

Policy Type (3 reports):

Alerts Triggered by Default Alert Policies
Alerts Triggered by User Created Alert Policies
All Alerts Triggered by Alert Policies

Office 365 Secure Score Reports (34 reports):

Overall Secure Score (5 reports):

Tenant’s Overall Score Trend
Security Settings Daily Scores
Security Settings Recent Scores
Security Settings Scored Zero
Security Settings Scored Full

MFA Score (2 reports):

Admin MFA Score Trend
MFA Registration Score Trend

MDM Score (13 reports):

MFA Registration Score Trend
Manage Email Profile in MDM
Device Encryption in MDM
Disallow Jail Broken Devices in MDM
Policy to Report Violations
Inactivity Locking
Wipe on Multiple Sign-in Failure
Alpha Numeric Password in MDM
Minimum Password Length in MDM
Use Complex Password in MDM
Disable Password Expiry in MDM
Password Re-use in MDM
Password to Unlock Mobile in MDM

Azure AD Score (10 reports):

Sign-in Risk Policy
User Risk Policy
Legacy Authentication
Self Service Password Reset
Alternate Contact Information for Users
More than One Admin
Designate Non-global Administrative Roles
3rd Party App Integration Permission for Users
Password Hash Sync
TLS Deprecation

General Settings (1 report):

Customer Lock Box

Average Comparative Scores (3 reports):

Office 365 Secure Score – All Tenants
Office 365 Secure Score – Total Seats
Office 365 Secure Score – Industry Types

General Auditing (27 reports):

Overall Activities (9 reports):

All Activities
Activities by Admins
External User Activities
Guest User Activities
All Failed Activities
Top Activity Summary
Daily Activity Summary
Activities Count by User
Failed Activities Count by User

O365 Workload Based Activities (9 reports):

All Azure AD Activities
All Exchange Activities
All SharePoint Activities
All OneDrive Activities
All OneNote Activities
All PowerBI Activities
All Teams Activities
All Stream Activities
All Security & Compliance Activities
All Compliance Search Activities Performed by Admins

General (3 reports):

All File/Folder Sharing Activities
All File/Folder Access Activities
File Deletion

Anonymous User Activities
Anonymous Sharing Link Creations
Anonymous Sharing Link Usage

File/Folder Sharing Activities by External Users
File/Folders Shared to External Users
File/Folder Accesses by External Users

Office 365 Auditing Tool – Dashboards:

The auditing dashboards provide the summary view of the auditing events in different dimensions and you can navigate these dimensions just by few mouse clicks.

It gives the weekly, monthly and daily activities trend along with the top 10 activities in each Office 365 applications. This allows admins to verify any abnormal increase in the number of activities performed in their tenant. Also, admins can protect their organization from security threats by monitoring unusual activities and detecting anomalies with Office 365 alerting tool.

There is a dedicated dashboard given for monitoring the failed activities so that admin can get a clear overview of failed events and they can analyze the root causes of those activities and fix them as earliest.

Reporting Capabilities Highlights:

This Office 365 Auditing tool comes with advanced reporting capabilities which make tedious reporting task to an easier one.

Automatic Schedule – Schedule one or more reports to run automatically at the configured time and delivered straight to your preferred mail-ids.
Multi-tenant Support – Easily manage multiple office 365 tenants from a single window.
AI-powered Graphical Analytics – Get insights into any report and understand the data better in a visually appealing manner.
Advanced Alerts – Identify new risks and unusual activities through 1400+ Microsoft 365 activities.
Rich Filters – Apply filter on any columns to see only the required information and save the filter for future use.
Easy Customization – Allows you to easily customize the reports by rearranging, adding, or removing the columns and their size.
Report Export – Ability to export the reports to CSV, PDF, HTML, RAW, XLS, or XLSX formats.
User Friendly – Do complex tasks with few mouse clicks using a simple to use web-based interface.
Granular Access Delegation – Allow non-admins to view reports and statistics.
Easy Setup – Easy to set up. No prerequisites to install.
Auto Update – No maintenance as the tool will automatically update to the latest version.
Advanced Scheduling Capabilities – Easily schedule with views & filters, receive the scheduled reports only with the latest information, schedule with preferred column arrangements, etc.
Supports Modern Authentication – AdminDroid Office 365 Reporter is the first in the industry to offer complete modern authentication support for connecting Exchange Online and other Office 365 services.

AdminDroid Office 365 Auditing Tool – Release History:

Never Uninstall to Get an Update!

AdminDroid Office 365 reporting tool installation will be updated automatically to the latest version, using an auto-update channel.

Apr 01, 2023 – 170+ new reports, 8 new alert policies, EXO module upgradation, settings to personalize the experience and many more.

Nov 11, 2022 – Geo maps, Heat maps, 10+ new dashboards, 80+ new reports, and more.

Sep 27, 2021 – Added 115+ new reports, Advanced Alerts, Granular Delegation, 420+ Analytical Reports, AI-powered charts, Categorized Compliance Reports, Report Boards, and lot more.

July 21, 2020 – You can now hide the filter pane in the reports to get extra report-view-area. A visual indicator will be displayed when you hide the filter page with the number of filters applied, on the filter icon.

July 19, 2020 – Office 365 Modern Authentication Support, Manage Multiple Office 365 Tenants, Tenant-based Delegation, Intelligent Filtering in Schedule, Schedule with Views & Filters, Schedule with Preferred Columns, Subscribe Scheduled Reports, 2 New Dashboards, 150+ New Reports.

Dec 17, 2019 – Added an option to quickly copy any value from a report result to clipboard.

Dec 14, 2019 – Global Reader Support, Data Retention Settings, Disk Space Alerting, Activity Alerts Reporting, OneNote Auditing, Microsoft Teams Membership Auditing, 150+ New Reports, and more.

June 20, 2019 – 20+ New Office 365 Reports on Auditing Risky Sign-In Attempts, User Admin Role Changes, File Access Activities by Guest Users, and more.

Feb 27, 2019 – 100+ New Reports on Office 365 Secure Score, MFA/2FA, License Expiry, Password Expiry and more. 2 new Security Dashboards.

June 12, 2018 – 75+ New Exchange Online Reports, 5+ New Dashboards, AI Based Report Search Console and more awesome features.

Feb 27, 2018 – Added 100+ new reports: Inactive Users Report and Usage Reports on Exchange Online, SharePoint Online, OneDrive for Business, Skype for Business, Yammer, Microsoft Teams, Pro Plus and more.

Jan 11, 2018 – Added 20+ new reports: Power BI Auditing Reports, Usage & Adoption Analytics.

Dec 19, 2017 – Added 10+ new reports: Microsoft Teams Usage & Adoption Reports, External Users Reports, and more.

Oct 1, 2017 – Added 25+ new SharePoint Online Reports.

Sep 27, 2017 – Added 2 new dashboards: Users & Administrators activities trend, Office 365 Usage & Adoption.

Sep 25, 2017 – Added 15+ new Skype for Business Reports, 10+ General Auditing Reports, Smart Filters

Jun 30, 2017 – Added 30+ new OneDrive for Business Auditing Reports

May 17, 2017 – Added 170+ new Auditing Reports for Azure AD, Exchange Online, and SharePoint Online.

This Microsoft 365 Auditing tool originally published in Microsoft’s TechNet gallery. Since the TechNet gallery is under deprecation, you can download this tool from AdminDroid site directly.