O365 – O365 Audit log report (License change report), https://technet.microsoft.com/library/mt238501(v=exchg.160).aspx, https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Protection-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c?ui=en-US&rs=en-US&ad=US, O365 – PST Import with Azure Storage Explorer error, Publish Office Online Server (WAC) with F5 issue, Audiocodes Mediant – Forking/Alternative routing E1 and SIP, SKYPE FOR BUSINESS – User unable to change his status, SfB/Polycom – VVX IPPhones BToE (Shared desktop/VDI), Go to Reports and in the part Auditing, click on “Office 365 audit log report”. @McGregor_Mike - Use Audit Log Search under Security and Compliance.

Connect and engage across your organization. Administrator changes one or more properties of a user account. This is now the case, thanks to the feature called “O365 Audit log report”. You can connect with us at +91-124-4506200. It takes up to 12 hours for events in Exchange Online and Azure Active Directory. That would be great, isn’t it ? Search for actions taken by a specific administrator, Search for actions taken against a specific object. Help us improve this article with your feedback. Had a look through the log and couldn't find anything relevant. This should take around 2 hours to be effective. Which of the following retains the information it's storing when the system power is turned off? ( Log Out /  Select Search & Investigation, and then select Audit log search. Sign into the Security & Compliance Center with your Microsoft 365 Admin account. 01:13 PM. ; Select Search & Investigation, and then select Audit log search. It might not give you the details on what license is changed, but it might give you who performed a license change during a certain time to a certain user. Yes
11:42 AM Have you searched the audit log to see what happened? Change ), You are commenting using your Google account. Searching Administrator Audit Logs. That's never happened to our org. Azure Active Directory Audit Report Events, The license assigned to a user what changed. Audit Mailbox permission and property changes to keep the Exchange Online environment in check; Create alerts with your own custom messages to send to administrators.for specific actions.

Go to Reports and in the part Auditing, click on “Office 365 audit log report” The “Audit log search” page appear and you can now turn on the feature by clicking on the “Start recording user and admin activities” button. Strange issue overnight our 365 removed about 25 licenses without being told to. Within Audit Log Search use Change user license activity under User management.
Empowering technologists to achieve more by humanizing tech. I will reach out to my manager. I found where you would pull audit reports but it doesn't look like I have access to pull them. To enable the full year, you’ll need to have an Office 365 E5 subscription or an Office 365 Advanced Compliance add-on license with an E3/Exchange Online Plan 1, and you’ll need to send a request to Microsoft support to enroll in the program. Keep track of User log ons and log offs to monitor Office 365 users' behaviors. Originally the Office 365 Activity Report until April 2016, changes to the Office 365 Security & Compliance Center have made the audit log the primary source of viewing user and administrator activity across Office 365.