Enabling auditing in your O365 Tenant
Enabling auditing in your tenant is a one-time process. Follow these steps to turn it on:
In the Security & Compliance Center, click Search & investigation > Audit log search in the left navigation pane.
Click Start recording user and admin activities.
Note: If you don’t see this link, auditing has already been turned on for your organization.
Note: After you enable auditing, a message is displayed that says the organization settings are being updated and that you will be able to run a search in a couple of hours after the preparation is complete.