Enabling auditing in your O365 tenant

Enabling auditing in your tenant is a one-time process. Follow these steps to turn it on:

1. In the Security & Compliance Center, click Search & investigation > Audit log search in the left navigation pane.

2. Click Start recording user and admin activities.

Note: If you don’t see this link, auditing has already been turned on for your organization.

Note: After you enable auditing, a message is displayed that says the organization settings are being updated and that you will be able to run a search in a couple of hours after the preparation is complete.