Monitor User Activities in Microsoft 365 (2024)

• User’s Sign-in Activities: Keeps track of when Microsoft users login and log out, including successful and failed log-in attempts.
• EXO Mailbox Activities: Monitoring actions such as sending, receiving, forwarding deleting, or moving emails within Exchange Online.
• SPO File and Folder Activities: Tracks user interactions on files & folders in SharePoint Online and OneDrive for Business that includes views, edits, uploads, downloads, and deletions.
• External Sharing and Collaboration Activities: Monitors user activities related to sharing files, folders, & sites that include invitations sent, and granting & revoking permissions during external collaboration.
• MS Teams Collaboration Activities: Tracks user interactions within Microsoft Teams, such as channel creations, posting messages, file sharing, and meeting attendance.
• Security and Compliance: Recording security-related events, such as policy changes, malware detection, data loss prevention (DLP) violations, and suspicious sign-in attempts.

• With the Microsoft 365 Usage and Adoption dashboard, you gain insights into user engagement by reviewing the number of activities, active users, and licensed users across different categories. This dashboard can be accessed from Dashboards»Usage & Adoption.
• View activities by specific departments, job titles, cities, or states using the filters available for Event Time, Workload, and Operation.

• Proactively tracking employee activities can provide valuable insights into their Microsoft 365 service usage, licensing optimization, and other essential information.
• It helps in identifying and responding to unusual or unauthorized activities to prevent security breaches and insider threats.
• One of the main reasons for tracking user behavior is to maintain adherence to compliane regulations and internal policies by generating audit trails and compliance reports.

• Filtering Logs: Narrow down the audit logs by specifying the time frame, usernames, activities, and other relevant criteria to focus on specific events of interest.
• Identifying Anomalies: Look for any unusual or suspicious activities that may indicate potential security threats or policy violations within the organization.
• Correlating Events: Associate audit events to identify unusual patterns or trends in user behavior, such as unauthorized access attempts, privilege escalation, or data exfiltration.
• Investigating Incidents: Investigate any identified incidents or security breaches by analyzing the details provided in the audit logs, including performed users, the affected resources, and the actions performed.
• Documenting Findings: For future reference and reporting needs, record the results of the audit log analysis, including any suspicious activity, security events, or compliance violations.

• Audit Logs in Microsoft Purview Portal This portal provides comprehensive monitoring of user activities, including administrative actions, security-related events, changes made by users, etc. It tracks activities such as file access attempts, mailbox changes, and permission modifications, helping to identify potential risks and ensure compliance.
• User Activity Reports in Microsoft 365 Admin Center It provides a broader view of general user engagement with Microsoft 365 services. It shows how many users are using specific features like email, OneDrive storage, Teams chat, Teams meeting, and so on. This helps with license management and productivity enhancement.

• Sign in to Microsoft 365 admin center and navigate to Usage Reports.
• Choose Time Frame: On the Active Users dashboard, pick the time frame - like past 7, 30, 90, or 180 days.
• Review Comprehensive Report: After selecting the time frame, the dashboard will show a detailed report of user activity for the period.

• Detect Anomalies in EXO: Use email security reports in Exchange Online to track unusual logins, suspicious file downloads, and excessive email forwarding to identify potential breaches and insider threats.
• Enforce Data Loss Prevention (DLP) in SPO: Monitor sensitive data, such as credit card numbers and social security numbers, being shared externally to prevent accidental leaks. Implement DLP policies in SharePoint Online to safeguard this data.
• Gain User Behavior Insights in O365: Understand typical email and file sharing patterns within your office 365 environment to identify anomalies that might signal account compromise.
• Respond Faster to Threats: Early detection of suspicious activity within your M365 tenant allows for quicker response, minimizing damage from cyberattacks.
• Maintain Compliance: Monitor activities to ensure adherence to compliance regulations and internal policies regarding data handling.

• Microsoft 365 E5 or Microsoft 365 E5 Compliance Add-on Licenses For users with these licenses, audit log records are retained for one year by default.
• Other Microsoft 365 or Microsoft 365 Licenses For users with all other license types (except E5), audit log records are retained for 180 days by default. (This is an improvement from the previous 90-day standard retention period implemented in October 2023.)
• Microsoft 365 Audit Premium Add-on License The Microsoft 365 Audit Premium add-on license enhances activity monitoring with advanced auditing capabilities, including up to one-year log retention, detailed event logs, and intelligent insights.

• Audit log retention policies can be created and managed in the Microsoft Purview portal.
• Licensing requirements determine how long audit logs are retained, with extended durations available for users with specific licenses.
• Policies allow organizations to specify how long to retain audit logs, with options ranging up to 10 years.
• Policies can be based on criteria such as Microsoft 365 services, specific activities, and user priorities.
• The default audit log retention policy retains records for Exchange Online, SharePoint Online, OneDrive, and Microsoft Entra for one year.
• Audit log retention policies can also be managed using PowerShell commands, providing flexibility and control.
• Custom audit log retention policies take priority over default policies.

Forget data retention limits! Admindroid lets you keep historical data for as long as you need.

With Admindroid, override the default limit of native audit log retention and preserve the audit data indefinitely.