
Open a blank workbook in Excel for Office 365, Excel 2019, or Excel 2016. This can help you quickly locate the specific auditing data you're looking for. Then you filter columns to view records based on the values of specific properties. The next step is to use the JSON transform feature in the Power Query Editor in Excel to split each property in the JSON object in the AuditData column into its own column. Step 2: Format the exported audit log using the Power Query Editor You might have to run multiple searches with smaller date ranges to export more than 50,000 entries. To export more than this limit, try using a narrower date range to reduce the number of audit log records.

If 50,000 entries are downloaded to the CSV file, you can probably assume there are more than 50,000 events that met the search criteria. You can download a maximum of 50,000 entries to a CSV file from a single audit log search. You can also access the CSV file in the Downloads folder. Large files will result when searching for all activities or using a wide date range.Īfter the export process is complete, a message is displayed at the top of the window that prompts you to open the CSV file and save it to your local computer. It takes a while to prepare the download file for a large search. This option exports all the audit records from the audit log search you ran in step 1, and adds the raw data from the audit log to a CSV file. On the search results page, select Export. Run an audit log search and revise the search criteria if necessary until you have the desired results. The first step is to search the audit log and then export the results in a comma-separated value (CSV) file to your local computer.

Learn details about signing up and trial terms.

Start now at the Microsoft Purview compliance portal trials hub. If you're not an E5 customer, use the 90-day Microsoft Purview solutions trial to explore how additional Purview capabilities can help your organization manage data security and compliance needs.
