Office 365 Auditing Report Tool

This Office 365 auditing tool helps the administrators to visualize the activities happen inside their Office 365 environment in a clear way.

This tool provides more than 500+ out-of-the-box Office 365 auditing reports, which are widely sought after by several Office 365 administrators. These reports provide rich information that is required to monitor user activities, file and shared items efficiently.

The auditing dashboards show the summarized activities performed on Office 365 application such as Azure AD, Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Power BI and Security & Compliance Center.

Using this powerful Office 365 auditing software, IT administrators will not only be able to extract rich Office 365 auditing reports and statistics but can also schedule the reports and have them emailed at selected intervals.

 

You can Download the tool by clicking here.

 

Supported Services:

  •  Azure Active Directory Auditing (70 reports)
  •  Exchange Online Auditing (56 reports)
  •  SharePoint Online Auditing (57 reports)
  •  OneDrive Business Auditing (29 reports)
  •  Microsoft Teams Auditing (14 reports)
  •  Power BI Auditing (36 reports)
  •  Office 365 Activity Alerts Reports (111 reports)
  •  Office 365 Secure Score Reports (62 Reports)
  •  General Auditing (16 reports)

 

Azure Active Directory Auditing (70 reports)

  • User Logins (7 reports)

    • All User Logins
    • Successful User Logins
    • Failed User Logins
    • User’s Last Logon Time
    • Users’ First Logon Time of a Day
    • User’s Daily/Weekly/Monthly Login Count Summary
    • User’s Daily Login Failure Count Summary

 

  • User Changes (6 reports)

    • Created Users
    • Updated Users
    • Deleted Users
    • License Changes
    • MFA Enabled
    • All User Administrative Events

 

  • Password Changes (5 reports)

    • Password Reset by Admin
    • User Password Changes
    • Password Reset Forced
    • Password Reset by Users After it Expired 
    • All Password Changes

 

  • Group Changes (9 reports)

    • Created Groups
    • Updated Groups
    • Deleted Groups
    • Group Settings Changes
    • Group License Changes
    • Group Manager Changes
    • Group Member Changes
    • Group Owner Changes
    • Group Administration

 

  • Application Changes (10 reports)

    • Added Applications
    • Updated Applications
    • Deleted Applications
    • Consent to Applications
    • OAuth2 Permission Grant
    • App Role Assignments
    • Service Principal Changes
    • Credential Changes
    • Delegation Changes
    • All App Operations

 

  • Admin Role Changes (9 reports)

    • User added as Admin
    • Admin Access Removed
    • All Role Member Changes
    • Role Assignments
    • Role Scope Changes
    • Added Roles
    • Updated Roles
    • Deleted Roles
    • All Role Operations

 

  • Directory Changes (5 reports)

    • Domain Changes
    • Company Information
    • Settings Changes
    • Partner Record
    • All Directory Operations

 

  • Policy Changes (6 reports)

    • Added Policies
    • Updated Policies
    • Deleted Policies
    • Default Policy Assignments
    • Policy Credential Removals
    • All Policy Operations

 

  • Administrative Unit Changes (5 reports)

    • Added AUs
    • Updated AUs
    • Deleted AUs
    • AUs Member Changes
    • All AU Operations

 

  • Device Changes (8 reports)

    • Added Devices
    • Updated Devices
    • Deleted Devices
    • Device Configuration Changes
    • Device Owner Changes
    • Device User Changes
    • Device Credential Changes
    • All Device Operations

 

 Exchange Online Auditing (58 reports)

  • Mailbox Access Activities (3 reports)

    • Mailbox Owner Access
    • Mailbox Non-Owner Access
    • User’s Mailbox Logins

 

  • Mailbox Activities (5 reports)

    • Operations on Mail (Delete, Move, Copy…)
    • Bulk Operations on Mails (Delete, Move, Copy…)
    • User’s Send As Activities
    • User’s Send On Behalf Activities
    • Mailbox Item Creations

 

  • Mailbox Management Activities (13 reports)

    • Added Mailbox
    • Updated Mailbox
    • Removed Mailbox
    • Mailbox Enable/Disable Activities
    • Mailbox Restore Activities
    • Mailbox Permission Changes
    • Send As Permission Changes
    • Mailbox Configuration Changes
    • Outlook Apps
    • Inbox Features
    • Create or Update Inbox Rules
    • Inbox Rule Changes
    • All Mailbox Operations

 

  • Public Folder Changes (6 reports)

    • Recently Added Public Folders
    • Recently Updated Public Folders
    • Recently Removed Public Folders
    • Public Folder Permission Changes
    • Activities on Mail Public Folders
    • All Activities on Public Folders

 

  • Advanced Threat Protection (8 reports)

    • Safe Attachments Config Changes
    • Safe Link Config Changes
    • Anti-Spam Config Changes
    • Anti-Malware Config Changes
    • Phishing Filter Config Changes
    • Junk Email Config Changes
    • DKIM Config Changes
    • All Advanced Threat Protection(ATP) Activities

 

  • Role Changes (6 reports)

    • Management Role Changes
    • Role Assignments Changes
    • Role Assignments Policy Changes
    • Role Entry Changes
    • Role Group Changes
    • Role Scope Changes

 

  • Group & Contact Changes (5 reports)

    • Office 365 Group
    • Distribution Group
    • Dynamic Distribution Group
    • All Group Changes
    • Mail Contact Changes

 

  • Mail Flow Activities (7 reports)

    • Mail Flow Configuration Changes
    • Transport Rule Changes
    • Connector Changes
    • Accepted Domain Configuration
    • Remote Domain Configuration
    • Hybrid Configuration Chanages
    • Federation Configuration Changes

 

  • Mobile Device Activities (3 reports)

    • Mobile Device
    • Exchange ActiveSync Configuration Changes
    • Text Message Settings Changes

 

  • Exchange DLP Activities (2 reports)

    • DLP Rule Detected Mails
    • Data Loss Prevention Configuration Changes

 

SharePoint Online Auditing (57 reports)

  • Site Collection Changes (4 reports)

    • Site Collections Created
    • Site Collection Admin Added
    • Site Collection Admin Removed
    • Site Collection Admin Change Request

 

  • Groups Changes (5 reports)

    • Created SharePoint Groups
    • Updated SharePoint Groups
    • Deleted SharePoint Groups
    • Member Added in SharePoint Groups
    • Member Removed from SharePoint Groups

 

  • Access Request Activities (4 reports)

    • Created Access Requests
    • Accepted Access Requests
    • Denied Access Requests
    • All Access Request Events

 

  • Sharing Invitation Activities (4 reports)

    • Created Sharing Invitations
    • Accepted Sharing Invitations
    • Revoked Sharing Invitations
    • All Events Related to Sharing Invitations

 

  • Company Links Changes (4 reports)

    • Created Company Links
    • Removed Company Links
    • Access Using Company Links
    • All Events Related to Company Links

 

  • Anonymous Links Changes (5 reports)

    • Created Anonymous Links
    • Removed Anonymous Links
    • Updated Anonymous Links
    • Access Using Anonymous Links
    • All Events Related to Anonymous Links

 

  • User Share Activities (2 reports)

    • User Shared Files, Folders or Site
    • User Unshared Files, Folder or Site

 

  • File Changes (13 reports)

    • Accessed SharePoint Files
    • Modified SharePoint Files
    • Uploaded SharePoint Files
    • Downloaded SharePoint Files
    • Renamed SharePoint Files
    • Copied SharePoint Files
    • Moved SharePoint Files
    • Deleted SharePoint Files
    • Restored SharePoint Files
    • Fetched SharePoint Files
    • Previewed SharePoint Files
    • SharePoint Document Library Activities
    • All Activities Related to SharePoint Files

 

  • Folder Changes (8 reports)

    • Created SharePoint Folders
    • Modified SharePoint Folders
    • Renamed SharePoint Folders
    • Moved SharePoint Folders
    • Copied SharePoint Folders
    • Deleted SharePoint Folders
    • Restored SharePoint Folders
    • All Activities Related to SharePoint Folders

 

  • Page Changes (5 reports)

    • Viewed SharePoint Pages
    • Moved SharePoint Pages
    • Deleted SharePoint Pages
    • Restored SharePoint Pages
    • All Activities Related to SharePoint Pages

 

  • SharePoint DLP Activities (3 reports)

    • SharePoint DLP Rule Matches
    • SharePoint DLP Rule Undo
    • All SharePoint DLP Actions

 

OneDrive Business Auditing (29 reports)

  • Activities on Files (10 reports)

    • Accessed OneDrive Files
    • Modified OneDrive Files
    • Uploaded OneDrive Files
    • Downloaded OneDrive Files
    • Renamed OneDrive Files
    • Copied OneDrive Files
    • Moved OneDrive Files
    • Deleted OneDrive Files
    • Restored OneDrive Files
    • All Activities Related to OneDrive Files

 

  • Activities on Folders (8 reports)

    • Created OneDrive Folders
    • Modified OneDrive Folders
    • Renamed OneDrive Folders
    • Moved OneDrive Folders
    • Copied OneDrive Folders
    • Deleted OneDrive Folders
    • Restored OneDrive Folders
    • All Activities Related to OneDrive Folders

 

  • Company Link Activities (4 reports)

    • Created Company Links
    • Removed Company Links
    • Access using Company Links
    • All Events Related to Company Links

 

  • Anonymous Link Activities (5 reports)

    • Created Anonymous Links
    • Removed Anonymous Links
    • Updated Anonymous Links
    • Access Using Anonymous Links
    • All Events Related to Anonymous Links

 

  • User’s Sharing Activities (2 reports)

    • User Shared Files or Folders
    • User Unshared Files or Folder

 

Teams Auditing (14 reports)

  • Login & Settings (2 reports)

    • Teams Login Activities
    • Settings Changes

 

  • Teams & Channels Management Activities (2 reports)

    • Teams Activities
    • Channel Activities

 

  • Teams Member Changes Report (6 reports)

    • Members Added in Teams
    • Member Removed from Teams
    • Owner Added to Teams
    • Owner Removed from Teams
    • Ownership Promoted in Teams
    • Ownership Demoted in Teams

 

  • AddOn Management (4 reports)

    • All AddOn Activities
    • Activities On Teams Bot
    • Activities On Teams Connectors
    • Activities On Teams Tabs

 

 Power BI Auditing (36 reports)

  • General Power BI Reports (9 reports)

    • Power BI Management Actions
    • Sharing Activities on Power BI Dashboards and Reports
    • Viewing Activities on Power BI Dashboards, Reports and Usage Metrics
    • Opt-In for Power BI Pro Trial
    • Actvities on Power BI Dashboards
    • Actvities on Power BI Reports
    • Actvities on Power BI Apps
    • Actvities on Power BI Datasets
    • Activities on Power BI Dataflows

 

  • Activities on Power BI Dashboards (7 reports)

    • Recently Created Power BI Dashboards
    • Recently Deleted Power BI Dashboards
    • Recently Edited Power BI Dashboards
    • Recently Viewed Power BI Dashboards
    • Recently Shared Power BI Dashboards
    • Recently Printed Power BI Dashboards
    • Recently Exported Power BI Dashboards

 

  • Activities on Power BI Reports (9 reports)

    • Recently Created Power BI Reports
    • Recently Deleted Power BI Reports
    • Recently Edited Power BI Reports
    • Recently Viewed Power BI Reports
    • Recently Shared Power BI Reports
    • Recently Published Power BI Reports
    • Recently Printed Power BI Reports
    • Recently Exported Power BI Reports
    • Recently Downloaded Power BI Reports

 

  • Activities on Power BI Datasets (5 reports)

    • Recently Created Power BI Datasets
    • Recently Deleted Power BI Datasets
    • Recently Edited Power BI Datasets
    • Refresh Requested Power BI Datasets
    • Power BI Dataset Refresh Setup

 

  • Activities on Power BI Dataflows (6 reports)

    • Recently Created Power BI Dataflows
    • Recently Updated Power BI Dataflows
    • Recently Viewed Power BI Dataflows
    • Power BI Dataflow Refresh Requested
    • Power BI Dataflow Refresh Setup
    • Power Bi Dataflow Refresh Cancelled

 

Office 365 Activity Alerts Reports (111 Reports)

  • Overall Alerts (2 Reports)

    • All Alerts on User Activities
    • All Triggered Alert Policies

 

  • Daily Summary (3 Reports)

    • Daily Summary of User Alerts
    • Daily Summary of User Alerts by Activity
    • Daily Summary of User Alerts by Activity Type

 

  • All Users Summary (8 Reports)

    • Alerts Summary by Users
    • User Alerts Summary by Activity
    • User Alerts Summary by Activity Type
    • User Alerts Summary by Policy Name
    • User Alerts Summary by Severity Status
    • User Alerts Summary by Category
    • User Alerts Summary by Creation Type
    • User Alerts Summary by System Policy

 

  • External User Summary (8 Reports)

    • Alerts Summary by External Users
    • External User Alerts Summary by Activity
    • External User Alerts Summary by Activity Type
    • External User Alerts Summary by Policy Name
    • External User Alerts Summary by Severity Status
    • External User Alerts Summary by Category
    • External User Alerts Summary by System Policy
    • External User Alerts Summary by System Policy

 

  • General Activities (12 Reports)

    • Alerts on Mail Forward/Redirection Rule Creation
    • Alerts on External File Sharing
    • Alerts on External User File Activity
    • Alerts on DLP Policy Match
    • Alerts on eDiscovery Search/Export
    • Alerts on Mailbox Permission Granting
    • Alerts on Exchange Admin Permission Granting
    • Alerts on User Reported an Email
    • Alerts on Malware Detection in File
    • Alerts on File/Folder Sharing
    • Alerts on File/Folder Activity
    • Alerts on File/Folder Changes

 

  • File and Folder Alerts (12 Reports)

    • Alerts on File Access
    • Alerts on File Deletion
    • Alerts on File Downloading
    • Alerts on File Copying
    • Alerts on File Modification
    • Alerts on Moving File
    • Alerts on Renaming File
    • Alerts on Restoring File
    • Alerts on File Check-in
    • Alerts on File Check-out
    • Alerts on File Check-out Discarding
    • Alerts on File Uploading

 

  • File Sharing Alerts (12 Reports)

    • Alerts on File/Folder/Site Sharing
    • Alerts on Sharing Invitation Creation
    • Alerts on Sharing Invitation Acceptance
    • Alerts on Access Request Creation
    • Alerts on Access Request Acceptance
    • Alerts on Access Request is Denial
    • Alerts on Company Shareable Link Creation
    • Alerts on Company Shareable Link Removal
    • Alerts on Anonymous Link Creation
    • Alerts on Anonymous Link Usage
    • Alerts on Anonymous Link Update
    • Alerts on Anonymous Link is Removal

 

  • Site Administartion Alerts (28 Reports)

    • Alerts on User-Agent Additions in the SharePoint Admin Center
    • Alerts on User Agents Changes in the SharePoint Admin Center
    • Alerts on Enabling Document Preview for a Site
    • Alerts on Enabling Legacy Workflow for a Site
    • Alerts on Enabling Office on Demand for a Site
    • Alerts on Enabling RSS Feeds for a Site
    • Alerts on Site Collection Creation
    • Alerts on New Site Collection Admin
    • Alerts on Site Admin Permission Requests
    • Alerts on Changing a Sharing Policy for SharePoint
    • Alerts on Updating People Search Source for a Site
    • Alerts on Setting Host Site for OneDrive
    • Alerts on Renaming SharePoint Site
    • Alerts on Granting Users for Group Creation
    • Alerts on Sent to Connection Creation in SharePoint
    • Alerts on Sent to Connection Deletion in SharePoint
    • Alerts on New of User/Group in SharePoint
    • Alerts on SharePoint Group Creation
    • Alerts on SharePoint Group Deletion
    • Alerts on SharePoint Group Setting Changes
    • Alerts on Group Permission Modification for a Site
    • Alerts on Group Member Removal in SharePoint Group
    • Alerts on User Establishes Site to Computer Sync
    • Alerts on User Blocked to Sync a Site to Computer
    • Alerts on Downloading a File by Syncing
    • Alerts on Downloading File Changes by Syncing
    • Alerts on Uploading a File by Syncing
    • Alerts on Uploading File Changes by Syncing

 

  • External Users (4 Reports)

    • Alerts on All External User Activities
    • Alerts on External User Common Activities
    • Alerts on External User File and Folder Activities
    • Alerts on External User File Sharing Activities

 

  • Daily Summary (2 Reports)

    • Daily Summary of Alerts by Activity
    • Daily Summary of Alerts by Activity Type

 

  • Trigger Summary (7 Reports)

    • Overall Alerts Summary by Activity
    • Overall Alerts Summary by Activity Type
    • Overall Alerts Summary by Policy Name
    • Overall Alerts Summary by Severity Status
    • Overall Alerts Summary by Category
    • Overall Alerts Summary by Creation Type
    • Overall Alerts Summary by System Policy

 

  • Alert Severity (4 Reports)

    • Alerts on High Severity
    • Alerts on Medium Severity
    • Alerts on Low Severity
    • Alerts on Informational Events

 

  • Alert Category (6 Reports)

    • Alerts on Data Loss Prevention
    • Alerts on Threat Management
    • Alerts on Data Governance
    • Alerts on Permissions
    • Alerts on Mail Flow
    • Alerts on Uncategorized Activities

 

  • Policy Type (3 Reports)

    • Alerts Triggered by Default Alert Policies
    • Alerts Triggered by User Created Alert Policies
    • All Alerts Triggered by Alert Policies

 

 General Auditing Reports (16 reports)

  • Overall Activities (3 reports)

    • All Activities
    • Activities by Admins
    • All Failed Activities

 

  • O365 Workload Based Activities (8 reports)

    • All Azure AD Activities
    • All Exchange Activities
    • All SharePoint Activities
    • All OneDrive Activities
    • All OneNote Activities
    • All Power BI Activities
    • All Teams Activities
    • All Security & Compliance Activities

 

  • Sharing & Access Activities (5 reports)

    • All File/Folder Sharing Activities
    • All File/Folder Access Activities
    • Anonymous User Activities
    • External User Activities
    • Guest User Activities

 

Office 365 Secure Score Reports (62 Reports)

  • Overall Secure Score: (5 Reports)

    • Tenant’s Overall Score Trend
    • Control Settings Scores Daily Trend
    • Control Settings Recent Scores
    • Scored Zero
    • Full Score.

 

  • MFA Score: (3 Reports)

    • Admin MFA Score Trend
    • User MFA Score Trend
    • MFA Registration Score Trend.

 

  • MDM Score: (13 Reports)

    • Enable Mobile Device Management
    • Manage Email Profile in MDM
    • Device Encryption in MDM
    • Disallow Jail Broken Devices in MDM
    • Policy to Report Violations
    • Inactivity Locking
    • Wipe on Multiple Sign-in Failure
    • Alpha Numeric Password in MDM
    • Minimum Password Length in MDM
    • Use Complex Password in MDM
    • Disable Password Expiry in MDM
    • Password Re-use in MDM
    • Password to Unlock Mobile in MDM.

 

  • Intune Score: (17 Reports)

    • Enable Intune MDM
    • Windows Defender ATP Integration
    • Mark Non-compliant Devices using Intune
    • Jailbreak Detection in Intune
    • Windows Information Protection Policy
    • iOS Compliance Policy in Intune
    • Android Compliance Policy in Intune
    • Android Work Compliance Policy in Intune
    • Windows Compliance Policy in Intune
    • Mac OS Compliance Policy in Intune
    • iOS App Compliance Policy in Intune
    • Android App Compliance Policy in Intune
    • Intune Configuration Profile for iOS
    • Intune Configuration Profile for Android
    • Intune Configuration Profile for Android Work
    • Intune Configuration Profile for Windows
    • Intune Configuration Profile for Mac OS.

 

  • Azure AD Score: (12 Reports)

    • Sign-in Risk Policy
    • User Risk Policy
    • Legacy Authentication
    • Self Service Password Reset
    • Alternate Contact Information for Users
    • Inactive Accounts
    • More than One Admin
    • Many Admins
    • Designate Non-global Administrative Roles
    • 3rd Party App Integration Permission for Users
    • Password Hash Sync
    • TLS Deprecation.

 

  • Exchange Score: (4 Reports)

    • Mailbox Auditing Score Trend
    • Disable Mailbox Delegation
    • Enable Safe Attachment Policies in ATP
    • Enable Safe Links Policies in ATP.

 

  • SharePoint Score: (4 Reports)

    • Apply IRM Protections
    • External Sharing Expiration
    • Versioning for Document Libraries
    • Anonymous Access.

 

  • OneDrive Score: (1 Report)

    • Adopt OneDrive for Business.

 

  • General Settings: (3 Reports)

    • Customer Lock Box
    • Cloud App Security
    • Data Loss Prevention Policies.

 

Office 365 Auditing Tool – Dashboards:

The auditing dashboards provide the summary view of the auditing events in different dimensions and you can navigate these dimensions just by few mouse clicks.

It gives the weekly, monthly and daily activities trend along with the top 10 activities in each Office 365 applications. This allows admins to verify any abnormal increase in the number of activities performed in their tenant.

There is a dedicated dashboard given for monitoring the failed activities so that admin can get a clear overview of failed events and they can analyze the root causes of those activities and fix them as earliest.

user activity dashboard Office 365 auditing tool

Office 365 auditing reporting tool

Office 365 audit dashboard

 

Reporting Capabilities Highlights:

This Office 365 Auditing tool comes with advanced reporting capabilities which make tedious reporting task to an easier one.
  • Automatic Schedule –  Schedule one or more reports to run automatically at the configured time and delivered straight to your preferred mail-ids.
  • Rich Filters – Apply filter on any columns to see only the required information and save the filter for future use.
  • Easy Customization – Allow you to easily customize the reports by rearranging, adding or removing the columns and its size.
  • Report Export – Ability to export the reports to CSV, PDF, HTML, RAW, XLS or XLSX.
  • User Friendly – Do complex tasks with few mouse clicks using a simple to use web-based interface.
  • Non-admin Delegation – Allow non-admins to view reports and statistics.
  • Easy Setup – Easy to set up. No prerequisites to install.
  • Auto Update – No maintenance as the product will automatically update to latest version.

 

Release Updates:

Dec 17, 2019 – Added an option to quickly copy any value from a report result to clipboard.

Dec 14, 2019 – Global Reader Support, Data Retention Settings, Disk Space Alerting, Activity Alerts Reporting, OneNote Auditing, Microsoft Teams Membership Auditing, 150+ New Reports, and more.

June 20, 2019 – 20+ New Office 365 Reports on Auditing Risky Sign-In Attempts, User Admin Role Changes, File Access Activities by Guest Users, and more.

Feb 27, 2019 – 100+ New Reports on Office 365 Secure Score, MFA/2FA, License Expiry, Password Expiry and more. 2 new Security Dashboards.

June 12, 2018 – 75+ New Exchange Online Reports, 5+ New Dashboards, AI Based Report Search Console and more awesome features.

Feb 27, 2018 – Added 100+ new reports: Inactive Users Report and Usage Reports on Exchange Online, SharePoint Online, OneDrive for Business, Skype for Business, Yammer, Microsoft Teams, Pro Plus and more.

Jan 11, 2018 – Added 20+ new reports: Power BI Auditing Reports, Usage & Adoption Analytics.

Dec 19, 2017 – Added 10+ new reports: Microsoft Teams Usage & Adoption Reports, External Users Reports, and more.

Oct 1, 2017 – Added 25+ new SharePoint Online Reports.

Sep 27, 2017 – Added 2 new dashboards: Users & Administrators activities trend, Office 365 Usage & Adoption.

Sep 25, 2017 – Added 15+ new Skype for Business Reports, 10+ General Auditing Reports, Smart Filters

Jun 30, 2017 – Added 30+ new OneDrive for Business Auditing Reports

May 17, 2017 – Added 170+ new Auditing Reports for Azure AD, Exchange Online, and SharePoint Online.

 

This Office 365 Auditing Reporting tool originally published in Microsoft’s TechNet gallery. Since the TechNet gallery is under deprecation, you can download this tool from AdminDroid site directly.