Enable the Audit Log in Office 365

The Audit Log in Office 365 is disabled, by default, presumably to save disk space.  To enable the audit log in your tenant, in the Office 365 Admin Portal browse to the Security & Compliance Admin Center -> Search & investigation -> Audit log search. Click Start recording user and admin activities then click Turn On.

Or you can use this PowerShell command:

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Source: TechNet

Digiprove sealCopyright secured by Digiprove © 2017 Douglas Spicer