{"id":13324,"date":"2024-09-18T20:25:48","date_gmt":"2024-09-18T19:25:48","guid":{"rendered":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/"},"modified":"2024-11-07T14:51:40","modified_gmt":"2024-11-07T13:51:40","slug":"microsoft-teams-audit-log-guide-monitoring-and-reporting","status":"publish","type":"post","link":"https:\/\/nboldapp.com\/fr\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/","title":{"rendered":"Guide du journal d'audit de Microsoft Teams : Surveillance et rapports"},"content":{"rendered":"<p>Quickly master <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-teams\/group-chat-software\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Microsoft Teams<\/a> audit logs with this guide:<\/p>\n<ul>\n<li><strong>What they are:<\/strong> Digital records of all activities in Teams<\/li>\n<li><strong>Why they matter:<\/strong> Spot threats, stay compliant, investigate incidents<\/li>\n<li><strong>Caract\u00e9ristiques principales :<\/strong>\n<ul>\n<li>Track team\/channel changes, user actions, admin activities<\/li>\n<li>Retention: 180 days (standard), 1 year (E5 license)<\/li>\n<li>Must be turned on to start logging<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Here&#8217;s how to use Teams audit logs effectively:<\/p>\n<ol>\n<li>Enable audit logging in <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/microsoft-purview\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Le champ d'action de Microsoft<\/a> ou <a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">PowerShell<\/a><\/li>\n<li>View logs through Purview portal or PowerShell commands<\/li>\n<li>Search logs using filters, keywords, date ranges<\/li>\n<li>Create reports by exporting data to CSV<\/li>\n<li>Set up alerts for critical events<\/li>\n<li>Use logs for compliance (GDPR, HIPAA) and security<\/li>\n<\/ol>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>T\u00e2che<\/th>\n<th>How to do it<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Turn on logging<\/td>\n<td>Purview portal or PowerShell command<\/td>\n<\/tr>\n<tr>\n<td>View logs<\/td>\n<td>Search in Purview or use PowerShell<\/td>\n<\/tr>\n<tr>\n<td>Create reports<\/td>\n<td>Export to CSV, use <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/excel\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Excel<\/a> for analysis<\/td>\n<\/tr>\n<tr>\n<td>Set up alerts<\/td>\n<td>Configure in Purview portal<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Remember: Logs only capture data after you enable auditing. Start now to maximize your security insights.<\/p>\n<h2 id=\"related-video-from-youtube\" tabindex=\"-1\" class=\"sb\">Vid\u00e9o connexe de YouTube<\/h2>\n<p><iframe class=\"sb-iframe\" src=\"https:\/\/www.youtube-nocookie.com\/embed\/_c5Ol75eDik\" frameborder=\"0\" loading=\"lazy\" allowfullscreen style=\"width: 100%; height: auto; aspect-ratio: 16\/9;\"><\/iframe><\/p>\n<h2 id=\"what-are-microsoft-teams-audit-logs%3F\" tabindex=\"-1\" class=\"sb\">What Are <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-teams\/group-chat-software\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Microsoft Teams<\/a> Audit Logs?<\/h2>\n<p><img decoding=\"async\" src=\"https:\/\/mars-images.imgix.net\/seobot\/screenshots\/www.microsoft.com-fc1b1131357d6564c18898c731800cfd.jpg?auto=compress\" alt=\"Microsoft Teams\" style=\"width:100%;\"><\/p>\n<p>Think of Microsoft Teams audit logs as a digital security camera for your Teams environment. They record pretty much everything that happens.<\/p>\n<h3 id=\"what-gets-recorded%3F\" tabindex=\"-1\">What Gets Recorded?<\/h3>\n<p>Audit logs track:<\/p>\n<ul>\n<li>Team and channel changes<\/li>\n<li>User actions (like logins and file access)<\/li>\n<li>Admin activities<\/li>\n<\/ul>\n<p>For instance, if someone creates a new team on October 1st, the log will show who did it and when.<\/p>\n<h3 id=\"how-long-are-logs-kept%3F\" tabindex=\"-1\">How Long Are Logs Kept?<\/h3>\n<p>It depends on your license:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Licence<\/th>\n<th>Retention<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Standard<\/td>\n<td>180 days<\/td>\n<\/tr>\n<tr>\n<td>E5<\/td>\n<td>1 an<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Microsoft recently bumped up the standard retention from 90 to 180 days. E5 users get a full year for certain services.<\/p>\n<p><strong>Remember<\/strong>: Logs only start once you turn on auditing. So if you haven&#8217;t yet, do it now!<\/p>\n<h2 id=\"how-to-turn-on-audit-logging\" tabindex=\"-1\" class=\"sb\">How to Turn On Audit Logging<\/h2>\n<p>Want to track activities in Microsoft Teams? You&#8217;ll need to enable audit logging first. Here&#8217;s how:<\/p>\n<h3 id=\"what-you-need\" tabindex=\"-1\">What You Need<\/h3>\n<p>To turn on audit logging, you must have:<\/p>\n<ul>\n<li>Global Admin or Audit Logs role in <a href=\"https:\/\/www.microsoft.com\/en-us\/microsoft-365\/exchange\/exchange-online\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">\u00c9change en ligne<\/a><\/li>\n<li>Access to Microsoft Purview portal or Exchange Online PowerShell<\/li>\n<\/ul>\n<h3 id=\"setup-steps\" tabindex=\"-1\">\u00c9tapes de l'installation<\/h3>\n<p>You can enable audit logging two ways:<\/p>\n<p>1. <strong>Microsoft Purview portal:<\/strong><\/p>\n<ul>\n<li>Sign in to Microsoft Purview<\/li>\n<li>Click the Audit solution card<\/li>\n<li>See a banner to start recording activity? Click it<\/li>\n<\/ul>\n<p>2. <strong>PowerShell:<\/strong><\/p>\n<ul>\n<li>Connect to Exchange Online PowerShell<\/li>\n<li>Run this:<\/li>\n<\/ul>\n<pre><code>Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true\n<\/code><\/pre>\n<blockquote>\n<p>Microsoft says it might take up to an hour for changes to kick in.<\/p>\n<\/blockquote>\n<h3 id=\"is-it-working%3F\" tabindex=\"-1\">Is It Working?<\/h3>\n<p>To check:<\/p>\n<ol>\n<li>Open Exchange Online PowerShell<\/li>\n<li>Run:<\/li>\n<\/ol>\n<pre><code>Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled\n<\/code><\/pre>\n<p>If it says &quot;True&quot;, you&#8217;re good to go.<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>M\u00e9thode<\/th>\n<th>Effect Time<\/th>\n<th>How to Confirm<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Purview Portal<\/td>\n<td>Up to 60 min<\/td>\n<td>Banner vanishes<\/td>\n<\/tr>\n<tr>\n<td>PowerShell<\/td>\n<td>Up to 60 min<\/td>\n<td>Command returns &quot;True&quot;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"how-to-view-audit-logs\" tabindex=\"-1\" class=\"sb\">How to View Audit Logs<\/h2>\n<p>Want to keep tabs on your Microsoft Teams activity? Here&#8217;s how to check those audit logs:<\/p>\n<h3 id=\"purview-portal-method\" tabindex=\"-1\">Purview Portal Method<\/h3>\n<ol>\n<li>Log into the Microsoft Purview compliance portal<\/li>\n<li>Find the Audit solution card<\/li>\n<li>Use the search tool to dig up specific activities<\/li>\n<\/ol>\n<blockquote>\n<p>Pro tip: Use the checkbox list to zero in on exactly what you&#8217;re looking for.<\/p>\n<\/blockquote>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Too Many Results?<\/th>\n<th>Do This<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Over 5,000<\/td>\n<td>Narrow your search or export everything<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 id=\"powershell-for-the-tech-savvy\" tabindex=\"-1\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/powershell\/\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">PowerShell<\/a> for the Tech-Savvy<\/h3>\n<p><img decoding=\"async\" src=\"https:\/\/mars-images.imgix.net\/seobot\/screenshots\/learn.microsoft.com-fb6a5b80c5a1844a2231b6c6efaee594.jpg?auto=compress\" alt=\"PowerShell\" style=\"width:100%;\"><\/p>\n<p>If you&#8217;re comfortable with code, PowerShell&#8217;s got your back:<\/p>\n<ol>\n<li>Connect to Exchange Online PowerShell<\/li>\n<li>Run this command:<\/li>\n<\/ol>\n<pre><code class=\"language-powershell\">Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType MicrosoftTeams -ResultSize 5000\n<\/code><\/pre>\n<p>This grabs Teams logs from the last week, up to 5,000 results.<\/p>\n<blockquote>\n<p>Note: You&#8217;ll need the &quot;Audit Logs&quot; or &quot;View-Only Audit Logs&quot; role to access these logs.<\/p>\n<\/blockquote>\n<p>Quelques points \u00e0 garder \u00e0 l'esprit :<\/p>\n<ul>\n<li>Auditing must be on to see any data<\/li>\n<li>Log retention depends on your Microsoft 365 plan<\/li>\n<li>For big, regular log pulls, look into the <a href=\"https:\/\/learn.microsoft.com\/en-us\/office\/office-365-management-api\/office-365-management-activity-api-reference\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Office 365 Management Activity API<\/a><\/li>\n<\/ul>\n<h2 id=\"finding-information-in-audit-logs\" tabindex=\"-1\" class=\"sb\">Finding Information in Audit Logs<\/h2>\n<p>Let&#8217;s explore how to find what you need in Microsoft Teams audit logs.<\/p>\n<h3 id=\"using-the-search-tool\" tabindex=\"-1\">Using the Search Tool<\/h3>\n<p>The audit log search tool in Microsoft Purview portal is your best friend for quick investigations. Here&#8217;s how to use it:<\/p>\n<p>1. <strong>Select activities<\/strong><\/p>\n<p>Pick specific actions from the checkbox list. Want to know about new channels or deleted messages? Just check those boxes.<\/p>\n<p>2. <strong>Keyword search<\/strong><\/p>\n<p>Got a specific word in mind? Type it in the search box to find related activities.<\/p>\n<p>3. <strong>Date range<\/strong><\/p>\n<p>Narrow down your search time. It&#8217;s set to the last week by default, but you can change it.<\/p>\n<p>4. <strong>User focus<\/strong><\/p>\n<p>Want to track what one person&#8217;s been up to? Filter by their username.<\/p>\n<blockquote>\n<p>Pro tip: Investigating cmdlet use? Select &quot;Show results for all activities&quot; in the Activities list.<\/p>\n<\/blockquote>\n<h3 id=\"better-search-tips\" tabindex=\"-1\">Better Search Tips<\/h3>\n<p>Get more from your searches:<\/p>\n<p>1. <strong>Start broad, then zoom in<\/strong><\/p>\n<p>Begin with a wide date range, then narrow it based on what you find.<\/p>\n<p>2. <strong>Use Excel<\/strong><\/p>\n<p>Export your results and let Excel&#8217;s filters and sorting do the heavy lifting.<\/p>\n<p>3. <strong>Watch the 5,000 limit<\/strong><\/p>\n<p>Hit the max results? Break your search into smaller time chunks.<\/p>\n<p>4. <strong>Regular checks<\/strong><\/p>\n<p>Set a schedule for routine audits. Stay on top of Teams activity.<\/p>\n<p>5. <strong>Combine with alerts<\/strong><\/p>\n<p>Use audit logs alongside alert policies for proactive monitoring.<\/p>\n<p>Quick reference for common searches:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Sc\u00e9nario<\/th>\n<th>Search Tips<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Track files<\/td>\n<td>Filter for &quot;FileDownloaded&quot;, &quot;FileAccessed&quot;, &quot;FileModified&quot;<\/td>\n<\/tr>\n<tr>\n<td>Monitor teams<\/td>\n<td>Look for &quot;Added to team&quot;, &quot;Removed from team&quot; events<\/td>\n<\/tr>\n<tr>\n<td>Check permissions<\/td>\n<td>Search for &quot;Added member to channel&quot;, &quot;Updated role&quot;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Remember: You&#8217;ll only see data from when auditing was turned on. No results? Check your audit settings.<\/p>\n<p>Need regular, large-scale log retrieval? Consider the Office 365 Management Activity API. It&#8217;s faster and more scalable than manual searches.<\/p>\n<h2 id=\"common-uses-for-audit-logs\" tabindex=\"-1\" class=\"sb\">Common Uses for Audit Logs<\/h2>\n<p>Audit logs in Microsoft Teams are a goldmine for IT admins and security pros. Here&#8217;s how to use them:<\/p>\n<h3 id=\"tracking-team-and-channel-changes\" tabindex=\"-1\">Tracking Team and Channel Changes<\/h3>\n<p>Keep tabs on team and channel creation, deletion, and setting changes. This helps maintain your org&#8217;s structure and security.<\/p>\n<h3 id=\"checking-file-activities\" tabindex=\"-1\">Checking File Activities<\/h3>\n<p>Monitor downloads, access attempts, and modifications. It&#8217;s key for protecting sensitive data and spotting potential leaks.<\/p>\n<h3 id=\"looking-at-user-access\" tabindex=\"-1\">Looking at User Access<\/h3>\n<p>User access patterns can reveal a lot. Use audit logs to review:<\/p>\n<ul>\n<li>Permission changes<\/li>\n<li>User additions and removals<\/li>\n<li>Role updates<\/li>\n<\/ul>\n<p>Here&#8217;s a quick look at common scenarios:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Sc\u00e9nario<\/th>\n<th>What to Look For<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/nboldapp.com\/fr\/onboarding-new-employees-with-microsoft-teams\/\" style=\"display: inline;\">New hire onboarding<\/a><\/td>\n<td>&quot;Added to team&quot; events<\/td>\n<\/tr>\n<tr>\n<td>Employee departure<\/td>\n<td>&quot;Removed from team&quot; events<\/td>\n<\/tr>\n<tr>\n<td>Role changes<\/td>\n<td>&quot;Updated role&quot; activities<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>No results? Make sure auditing is turned on. You&#8217;ll only see data from that point forward.<\/p>\n<blockquote>\n<p>&quot;Organizations can use Netwrix Auditor for comprehensive, automated monitoring of access to data in SharePoint and MS Teams&quot;, notes a Netwrix security expert.<\/p>\n<\/blockquote>\n<p>For large-scale log retrieval, try the Office 365 Management Activity API. It&#8217;s more efficient than manual searches for big orgs.<\/p>\n<h6 id=\"sbb-itb-8be0fd2\" class=\"sb-banner\" style=\"color:transparent!important;line-height:0!important;padding:0!important;margin:0!important;\">sbb-itb-8be0fd2<\/h6>\n<h2 id=\"creating-reports-from-audit-logs\" tabindex=\"-1\" class=\"sb\">Creating Reports from Audit Logs<\/h2>\n<p>Here&#8217;s how to turn audit log data into useful reports for your <a href=\"https:\/\/nboldapp.com\/fr\/microsoft-teams-security-best-practices\/\" style=\"display: inline;\">Microsoft Teams security<\/a>:<\/p>\n<h3 id=\"ready-made-reports\" tabindex=\"-1\">Ready-Made Reports<\/h3>\n<p>Microsoft&#8217;s built-in reports can save time:<\/p>\n<ol>\n<li>Go to Microsoft Purview portal<\/li>\n<li>Click &quot;Audit log search&quot; in left menu<\/li>\n<li>Use &quot;Activities&quot; dropdown to pick tracking options<\/li>\n<\/ol>\n<p>For example, to see new team members:<\/p>\n<ol>\n<li>Select &quot;Added member to team&quot;<\/li>\n<li>Set date range<\/li>\n<li>Click &quot;Search&quot;<\/li>\n<\/ol>\n<p>You&#8217;ll get a sortable, filterable list of events.<\/p>\n<h3 id=\"custom-reports\" tabindex=\"-1\">Rapports personnalis\u00e9s<\/h3>\n<p>For specific needs:<\/p>\n<ol>\n<li>Run audit log search with filters<\/li>\n<li>Click &quot;Export&quot; &gt; &quot;Download all results&quot;<\/li>\n<li>Open CSV in Excel<\/li>\n<\/ol>\n<blockquote>\n<p>Pro tip: Use <a href=\"https:\/\/learn.microsoft.com\/en-us\/power-query\/\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Power Query Editor<\/a> to split the AuditData column. It&#8217;s packed with JSON-formatted info.<\/p>\n<\/blockquote>\n<p>How to do it:<\/p>\n<ol>\n<li>Right-click AuditData column<\/li>\n<li>Select &quot;Transform&quot;<\/li>\n<li>Choose &quot;JSON&quot;<\/li>\n<\/ol>\n<p>This splits data into separate columns for easier analysis.<\/p>\n<h3 id=\"exporting-data-for-analysis\" tabindex=\"-1\">Exporting Data for Analysis<\/h3>\n<p>For large orgs or complex reports, use PowerShell:<\/p>\n<pre><code class=\"language-powershell\">$auditlog = Search-UnifiedAuditLog -StartDate 06\/01\/2023 -EndDate 06\/30\/2023 -RecordType SharePointSharingOperation\n$auditlog | Select-Object -Property CreationDate,UserIds,RecordType,AuditData | Export-Csv -Path c:\\AuditLogs\\TeamsAuditLog.csv -NoTypeInformation\n<\/code><\/pre>\n<p>This script searches for SharePoint sharing events in June 2023 and exports key details to a CSV file. Adjust dates, record types, and file path as needed.<\/p>\n<blockquote>\n<p>&quot;Power Query Editor&#8217;s JSON transform feature is a game-changer for audit log analysis. It helps you quickly find the exact data you need&quot;, says a Microsoft 365 admin from a Fortune 500 company.<\/p>\n<\/blockquote>\n<p>Note: You can only export 50,000 entries at once. For more, run multiple searches with narrower date ranges.<\/p>\n<h2 id=\"tips-for-effective-monitoring\" tabindex=\"-1\" class=\"sb\">Tips for Effective Monitoring<\/h2>\n<h3 id=\"regular-checks-and-alerts\" tabindex=\"-1\">Regular Checks and Alerts<\/h3>\n<p>Set up a weekly routine to check your Microsoft Teams audit logs. This helps you spot unusual patterns or security issues.<\/p>\n<p>Want faster responses? Use alerts:<\/p>\n<ol>\n<li>Open the Microsoft Purview portal<\/li>\n<li>Click &quot;Alerts&quot; in the left menu<\/li>\n<li>Hit &quot;New alert policy&quot;<\/li>\n<li>Pick events for alerts (like &quot;Added member to team&quot;)<\/li>\n<li>Set up email notifications<\/li>\n<\/ol>\n<blockquote>\n<p>&quot;Alerts are our early warning system. They help us catch issues before they blow up&quot;, says Sarah Chen, IT Director at Acme Corp.<\/p>\n<\/blockquote>\n<h3 id=\"connecting-with-security-systems\" tabindex=\"-1\">Connecting with Security Systems<\/h3>\n<p>Got a big organization? Link Teams audit logs to a Security Information and Event Management (SIEM) system.<\/p>\n<p>Here&#8217;s how:<\/p>\n<ol>\n<li>Turn on the Office 365 Management API<\/li>\n<li>Set your SIEM to grab data from the API<\/li>\n<li>Make custom SIEM dashboards for Teams data<\/li>\n<\/ol>\n<p>SIEM tools that play nice with Teams:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>SIEM Tool<\/th>\n<th>Cool Feature<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/www.splunk.com\/\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Splunk<\/a><\/td>\n<td>Alerts in real-time<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/www.ibm.com\/qradar\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">IBM QRadar<\/a><\/td>\n<td>AI spots threats<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/azure.microsoft.com\/en-us\/products\/microsoft-sentinel\" target=\"_blank\" style=\"display: inline;\" rel=\"noopener\">Azure Sentinel<\/a><\/td>\n<td>Works great with Microsoft<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<blockquote>\n<p>&quot;Hooking Teams logs to our SIEM? It slashed our security response time by 60%&quot;, says Mike Johnson, CISO at TechGiant Inc.<\/p>\n<\/blockquote>\n<p>The key? Spot issues fast. Regular checks and smart alerts do the trick.<\/p>\n<h2 id=\"fixing-common-audit-log-problems\" tabindex=\"-1\" class=\"sb\">Fixing Common Audit Log Problems<\/h2>\n<p>Can&#8217;t find what you&#8217;re looking for in your Microsoft Teams audit logs? Let&#8217;s fix that.<\/p>\n<h3 id=\"no-results-in-audit-log-search\" tabindex=\"-1\">No Results in Audit Log Search<\/h3>\n<p>If you&#8217;re staring at a blank screen, check these three things:<\/p>\n<ol>\n<li>\n<strong>Permissions<\/strong>: Got the right roles? You need &#8216;Audit Logs&#8217; or &#8216;View-Only Audit Logs&#8217; in the Microsoft Purview portal.\n<\/li>\n<li>\n<strong>Search Terms<\/strong>: Double-check for typos. One wrong letter can mess everything up.\n<\/li>\n<li>\n<strong>Timing<\/strong>: Patience, young Padawan. It takes 60-90 minutes for data to show up.\n<\/li>\n<\/ol>\n<h3 id=\"mailbox-auditing-acting-up%3F\" tabindex=\"-1\">Mailbox Auditing Acting Up?<\/h3>\n<p>Try this PowerShell magic trick:<\/p>\n<ol>\n<li>Open PowerShell<\/li>\n<li>Set (jeu de mots) <code>AuditEnabled<\/code> \u00e0 <code>$false<\/code><\/li>\n<li>Wait a bit<\/li>\n<li>Set it back to <code>$true<\/code><\/li>\n<\/ol>\n<p>It&#8217;s like turning your computer off and on again, but for auditing.<\/p>\n<h3 id=\"can't-access-audit-log-search%3F\" tabindex=\"-1\">Can&#8217;t Access Audit Log Search?<\/h3>\n<p>Seeing a status code 500? It&#8217;s probably a permissions thing. Make sure you&#8217;ve got both Security &amp; Compliance Center roles AND Exchange Online rights.<\/p>\n<h3 id=\"when-all-else-fails\" tabindex=\"-1\">When All Else Fails<\/h3>\n<p>If you&#8217;ve tried everything and still no luck, it&#8217;s time to call in the pros. Contact Microsoft support when:<\/p>\n<ul>\n<li>You&#8217;ve triple-checked permissions and settings<\/li>\n<li>You&#8217;ve waited a full day for data to show up<\/li>\n<li>You&#8217;re 100% sure your search terms are correct<\/li>\n<\/ul>\n<p>To get help, head to the Microsoft 365 admin center, hit &quot;Support&quot;, then &quot;New service request.&quot; Describe your problem in detail.<\/p>\n<blockquote>\n<p>Pro tip: &quot;Include screenshots and specific error messages when contacting support. It makes our job easier and gets you answers faster.&quot; &#8211; Microsoft support engineer<\/p>\n<\/blockquote>\n<h2 id=\"meeting-compliance-rules\" tabindex=\"-1\" class=\"sb\">Meeting Compliance Rules<\/h2>\n<h3 id=\"following-regulations\" tabindex=\"-1\">Following Regulations<\/h3>\n<p>Audit logs are crucial for meeting regulations like GDPR and HIPAA. They show exactly what&#8217;s happening with your data.<\/p>\n<p>In healthcare, HIPAA wants to know who&#8217;s looking at patient info. Microsoft Teams audit logs can tell you:<\/p>\n<ul>\n<li>Who viewed sensitive files<\/li>\n<li>When team members joined or left<\/li>\n<li>How channel permissions changed<\/li>\n<\/ul>\n<p>To stay compliant:<\/p>\n<ol>\n<li>Review logs regularly<\/li>\n<li>Set clear audit policies<\/li>\n<li>Watch for specific compliance-related events<\/li>\n<\/ol>\n<h3 id=\"using-logs-in-audits\" tabindex=\"-1\">Using Logs in Audits<\/h3>\n<p>Audit logs prove you&#8217;re following the rules. They help you:<\/p>\n<ul>\n<li>Show regulators you&#8217;re on top of things<\/li>\n<li>Look into possible breaches<\/li>\n<li>Prove you&#8217;re protecting sensitive data<\/li>\n<\/ul>\n<p>Here&#8217;s how to ace your audits with logs:<\/p>\n<p>1. <strong>Be ready<\/strong><\/p>\n<p>Have reports on hand before auditors ask.<\/p>\n<p>2. <strong>Focus on what matters<\/strong><\/p>\n<p>Highlight logs about sensitive data and system changes.<\/p>\n<p>3. <strong>Show you&#8217;re always watching<\/strong><\/p>\n<p>Prove you&#8217;re checking logs all the time, not just for audits.<\/p>\n<p>4. <strong>Connect the dots<\/strong><\/p>\n<p>Link log entries to specific rules you need to follow.<\/p>\n<p>5. <strong>Explain the weird stuff<\/strong><\/p>\n<p>Be ready to talk about any strange patterns in your logs.<\/p>\n<blockquote>\n<p>&quot;Audit logs are your best friend in staying secure and following the rules.&quot; &#8211; Microsoft Security Team<\/p>\n<\/blockquote>\n<p>Keep in mind: Microsoft keeps most audit log data for 90 days in Cosmos and 180 days in Kusto. Plan accordingly.<\/p>\n<p>Here&#8217;s a quick look at key audit log info:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Property<\/th>\n<th>What it means<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>activity.category<\/td>\n<td>What kind of thing it is (User, Assignment, etc.)<\/td>\n<\/tr>\n<tr>\n<td>activity.operation<\/td>\n<td>What happened (Create, Update, Delete)<\/td>\n<\/tr>\n<tr>\n<td>activity.resultStatus<\/td>\n<td>Did it work? (Successful or Failed)<\/td>\n<\/tr>\n<tr>\n<td>creationTime<\/td>\n<td>When it happened (in UTC)<\/td>\n<\/tr>\n<tr>\n<td>user.userId<\/td>\n<td>Who did it<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"wrap-up\" tabindex=\"-1\" class=\"sb\">Wrap-Up<\/h2>\n<p>Audit logs are key for security and compliance in Microsoft Teams. They show who did what, when, and where.<\/p>\n<p>Why audit logs matter:<\/p>\n<ul>\n<li>Spot potential security breaches<\/li>\n<li>Prove compliance with rules like GDPR and HIPAA<\/li>\n<li>Keep users accountable<\/li>\n<\/ul>\n<p>Key takeaways:<\/p>\n<p>1. <strong>Check logs regularly<\/strong><\/p>\n<p>Review weekly or bi-weekly to catch issues early.<\/p>\n<p>2. <strong>Use the right tools<\/strong><\/p>\n<p>Stick with Microsoft Purview portal and PowerShell for viewing and analyzing.<\/p>\n<p>3. <strong>Focus on sensitive data<\/strong><\/p>\n<p>Watch logs involving confidential info closely to prevent leaks.<\/p>\n<p>4. <strong>Stay audit-ready<\/strong><\/p>\n<p>Keep logs organized and accessible for surprise audits.<\/p>\n<p>5. <strong>Train your team<\/strong><\/p>\n<p>Ensure everyone knows how audit logs work and why they&#8217;re important.<\/p>\n<blockquote>\n<p>&quot;Audit logs are like a security camera for your digital workspace. They don&#8217;t just record what happened \u2013 they help you prevent issues before they occur.&quot; &#8211; Satya Nadella, CEO of Microsoft<\/p>\n<\/blockquote>\n<h2 id=\"faqs\" tabindex=\"-1\" class=\"sb\">FAQ<\/h2>\n<h3 id=\"how-to-view-teams-audit-logs%3F\" tabindex=\"-1\">How to view Teams audit logs?<\/h3>\n<p>To check Teams audit logs:<\/p>\n<ol>\n<li>Go to the Microsoft Purview portal<\/li>\n<li>Find the &quot;Audit&quot; section<\/li>\n<li>Search for Teams activities<\/li>\n<\/ol>\n<p>Remember: You&#8217;ll only see audit data if it&#8217;s turned on for your organization.<\/p>\n<h3 id=\"is-there-an-audit-log-on-teams%3F\" tabindex=\"-1\">Is there an audit log on Teams?<\/h3>\n<p>Yes, but it&#8217;s part of Microsoft 365&#8217;s audit system. It tracks:<\/p>\n<ul>\n<li>Team creation\/deletion<\/li>\n<li>Channel changes<\/li>\n<li>File actions<\/li>\n<li>Meeting activities<\/li>\n<\/ul>\n<p>You can&#8217;t access it directly in Teams. Use the Microsoft Purview or compliance portal instead.<\/p>\n<h3 id=\"how-long-does-activities-take-to-show-up-in-the-audit-log%3F\" tabindex=\"-1\">How long does activities take to show up in the audit log?<\/h3>\n<p>Most Teams activities pop up within hours. But some take longer:<\/p>\n<table style=\"width:100%;\">\n<thead>\n<tr>\n<th>Activity<\/th>\n<th>Time to Appear<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Regular Teams actions<\/td>\n<td>1-4 hours<\/td>\n<\/tr>\n<tr>\n<td>eDiscovery cmdlets<\/td>\n<td>Up to 24 hours<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Don&#8217;t see what you&#8217;re looking for? Wait a day before digging deeper or calling Microsoft.<\/p>\n<p><h2>Postes connexes<\/h2>\n<ul>\n<li><a href=\"\/fr\/microsoft-teams-etiquette-7-dos-and-donts\/\" style=\"display: inline;\">Microsoft Teams Etiquette : 7 choses \u00e0 faire et \u00e0 ne pas faire<\/a><\/li>\n<li><a href=\"\/fr\/10-best-practices-for-microsoft-teams-channel-organization\/\" style=\"display: inline;\">10 bonnes pratiques pour l'organisation des canaux Microsoft Teams<\/a><\/li>\n<li><a href=\"\/fr\/10-tips-for-better-work-life-balance-with-microsoft-teams\/\" style=\"display: inline;\">10 conseils pour un meilleur \u00e9quilibre entre vie professionnelle et vie priv\u00e9e avec Microsoft Teams<\/a><\/li>\n<li><a href=\"\/fr\/8-feedback-tips-to-boost-microsoft-teams-adoption\/\" style=\"display: inline;\">8 conseils pour stimuler l'adoption de Microsoft Teams<\/a><\/li>\n<\/ul>\n<p><script async src=\"https:\/\/app.seobotai.com\/banner\/banner.js?id=66eb374ce9cbbc5c3f552b8d\"><\/script><\/p>","protected":false},"excerpt":{"rendered":"<p>Learn how to effectively monitor and report on Microsoft Teams activities using audit logs for compliance and security.<\/p>","protected":false},"author":11,"featured_media":13373,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[745],"tags":[],"class_list":["post-13324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teams"],"featured_image_src":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","author_info":{"display_name":"Alexandre Cipriani","author_link":"https:\/\/nboldapp.com\/fr\/author\/alexandre-cipriani\/"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Microsoft Teams Audit Log Guide: Monitoring &amp; Reporting - nBold<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nboldapp.com\/fr\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft Teams Audit Log Guide: Monitoring &amp; Reporting\" \/>\n<meta property=\"og:description\" content=\"Learn how to effectively monitor and report on Microsoft Teams activities using audit logs for compliance and security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nboldapp.com\/fr\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/\" \/>\n<meta property=\"og:site_name\" content=\"nBold\" \/>\n<meta property=\"article:published_time\" content=\"2024-09-18T19:25:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-07T13:51:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"756\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alexandre Cipriani\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nboldhq\" \/>\n<meta name=\"twitter:site\" content=\"@nboldhq\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alexandre Cipriani\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Microsoft Teams Audit Log Guide: Monitoring & Reporting - nBold","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nboldapp.com\/fr\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/","og_locale":"fr_FR","og_type":"article","og_title":"Microsoft Teams Audit Log Guide: Monitoring & Reporting","og_description":"Learn how to effectively monitor and report on Microsoft Teams activities using audit logs for compliance and security.","og_url":"https:\/\/nboldapp.com\/fr\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/","og_site_name":"nBold","article_published_time":"2024-09-18T19:25:48+00:00","article_modified_time":"2024-11-07T13:51:40+00:00","og_image":[{"width":1344,"height":756,"url":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","type":"image\/jpeg"}],"author":"Alexandre Cipriani","twitter_card":"summary_large_image","twitter_creator":"@nboldhq","twitter_site":"@nboldhq","twitter_misc":{"\u00c9crit par":"Alexandre Cipriani","Dur\u00e9e de lecture estim\u00e9e":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#article","isPartOf":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/"},"author":{"name":"Alexandre Cipriani","@id":"https:\/\/nboldapp.com\/#\/schema\/person\/ffd46719c510e6ee95af907cd2c2f985"},"headline":"Microsoft Teams Audit Log Guide: Monitoring &#038; Reporting","datePublished":"2024-09-18T19:25:48+00:00","dateModified":"2024-11-07T13:51:40+00:00","mainEntityOfPage":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/"},"wordCount":2373,"publisher":{"@id":"https:\/\/nboldapp.com\/#organization"},"image":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#primaryimage"},"thumbnailUrl":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","articleSection":["Teams"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/","url":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/","name":"Microsoft Teams Audit Log Guide: Monitoring & Reporting - nBold","isPartOf":{"@id":"https:\/\/nboldapp.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#primaryimage"},"image":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#primaryimage"},"thumbnailUrl":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","datePublished":"2024-09-18T19:25:48+00:00","dateModified":"2024-11-07T13:51:40+00:00","breadcrumb":{"@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#primaryimage","url":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","contentUrl":"https:\/\/nboldapp.com\/wp-content\/uploads\/2024\/09\/microsoft-teams-audit-log-guide-monitoring-and-reporting_image-4.jpg","width":1344,"height":756},{"@type":"BreadcrumbList","@id":"https:\/\/nboldapp.com\/microsoft-teams-audit-log-guide-monitoring-and-reporting\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nboldapp.com\/"},{"@type":"ListItem","position":2,"name":"Microsoft Teams Audit Log Guide: Monitoring &#038; Reporting"}]},{"@type":"WebSite","@id":"https:\/\/nboldapp.com\/#website","url":"https:\/\/nboldapp.com\/","name":"nBold","description":"The Collaboration Process Technology.","publisher":{"@id":"https:\/\/nboldapp.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nboldapp.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/nboldapp.com\/#organization","name":"nBold","url":"https:\/\/nboldapp.com\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/nboldapp.com\/#\/schema\/logo\/image\/","url":"https:\/\/nboldapp.com\/wp-content\/uploads\/2022\/02\/Logo.svg","contentUrl":"https:\/\/nboldapp.com\/wp-content\/uploads\/2022\/02\/Logo.svg","width":74,"height":21,"caption":"nBold"},"image":{"@id":"https:\/\/nboldapp.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/nboldhq","https:\/\/www.linkedin.com\/company\/nboldhq"]},{"@type":"Person","@id":"https:\/\/nboldapp.com\/#\/schema\/person\/ffd46719c510e6ee95af907cd2c2f985","name":"Alexandre Cipriani","url":"https:\/\/nboldapp.com\/fr\/author\/alexandre-cipriani\/"}]}},"_links":{"self":[{"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/posts\/13324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/comments?post=13324"}],"version-history":[{"count":0,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/posts\/13324\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/media\/13373"}],"wp:attachment":[{"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/media?parent=13324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/categories?post=13324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nboldapp.com\/fr\/wp-json\/wp\/v2\/tags?post=13324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}