Planning for auditing and reporting

Tracking user and administrator activities is a crucial capability for any organization using Microsoft 365, and there are several auditing and reporting capabilities available that you will need to be aware of. But what sort of things do you need to consider? What activities should you be tracking and have visibility of? Examples may include the following:

• Documents changed by users
• Tenant configuration altered by admins

You can monitor such activities from the various Microsoft 365 admin portals to ensure that you have a robust strategy in place to mitigate any risks and ensure that your organization is fulfilling any regulatory compliance obligations.

Using tools such as the Microsoft Purview compliance portal and the Microsoft 365 Defender portal, you can access the appropriate navigation panes for features, which include the following:

• Alerts
• Permissions
• Data Lifecycle Management
• Threat management
...