We help IT Professionals succeed at work.

Office365 Centralize logs of all O365 and AAD services

Adam Anderson
is there a way to centralize all the O365 services logs and ADD service and then run queries across all the O365 services together.?
Watch Question

Adam BrownSenior Systems Admin
Top Expert 2010


You mean onprem AD or Azure AD? For Azure AD, the logging for both is available in the security and compliance portal: protection.office.com 

You can search the audit logs there by going to Search > Audit Logs > create a new search. It will generate a report of whatever activity you choose. 

If you want to unify Onprem AD and Office 365 logs, you'll need to implement Azure Sentinel, I believe. 

Most Valuable Expert 2015
Distinguished Expert 2019
Just to add to the above, if you mean exporting the logs to external location/system, or accessing them programmatically, you can do so via the O365 Management APIs: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

Explore More ContentExplore courses, solutions, and other research materials related to this topic.