Search the audit log for events in Microsoft Teams
The Microsoft Teams admin center is gradually replacing the Skype for Business admin center, and we're migrating Teams settings to it from the Microsoft 365 admin center. If a setting has been migrated, you'll see a notification and then be directed to the setting's location in the Teams admin center. For more information, see Manage Teams during the transition to the Teams admin center.
The audit log can help you investigate specific activities across Office 365 services. For Teams, here are some of the activities that are audited:
Audit events from private channels are also logged as they are for teams and standard channels.
To see the complete list of activities that are audited in Office 365, read Search the audit log in the Office 365 Security & Compliance Center.
Turn on auditing in Teams
Audit data is only available from the point at which you turned on Auditing.
Retrieve Teams data from the audit log
To retrieve audit logs, go to the Security & Compliance Center. Under Search & Investigation, select Audit log search.
Use Search to filter by the activities, dates, and users you want to audit.
Export your results to Excel for further analysis.
Audit data is only visible in the Audit Log if auditing is turned on.
Video: TechTip: Using Audit Log Search in Teams
Join Ansuman Acharya, a program manager for Teams, as he demonstrates conducting an Audit Log search for Teams in the Office 365 Security & Compliance Center.