Introducing SharePoint Online Auditing
SharePoint Online auditing features enable admins to track user activity on an organizational level. Through which Office 365 administrators, or the compliance admin, search through the logs and apply filters to identify exactly what they are looking for.
Follow the below steps to enable SharePoint online auditing.
Step 1: Open Office 365 in a Web browser
Step 2: Activate SharePoint Online Auditing
To activate SharePoint Online auditing, click on Security and Compliance Center from Office 365 to open Security and Compliance.
Once you open the Office 365 Security and Compliance Center, you will have to go to the Audit Log Search menu in the side navigation menu.
If you’re an Office 365 Global admin and viewing this page first time, then it means SharePoint Online auditing has not yet been activated. In that case, a message will appear prompting you to Start Recording User and Admin Activities, as seen in the image below.
Once this auditing feature is activated, you can begin auditing the content and users within the organization.
Usually with most Office 365 admin changes, this process may take up to 24 hours for results to appear when conducting a search.