sharepoint audit logs

Question

Hi All
i have an sharepoint site associated with office365 unified group, the site was deleted by some user, how can i check from the logs who has deleted this site.
i have used the below syntax from office 365 but i dont see any logs.
Search-AdminAuditLog -ExternalAccess $false -StartDate 09/20/2020 -EndDate 09/21/2020 | Export-Csv -Path C:\auditlogs.csv -NoTypeInformation

Answer 1

Hi @Roger Roger ,

AdminAuditLog is available in on-premises Exchange and in the cloud-based service, not for SharePoint online.

Use the Search-UnifiedAuditLog cmdlet to search the unified audit log from SharePoint Online.

Simple test for your reference:

$Audit=Search-UnifiedAuditLog -StartDate 9/1/2020 -EndDate 9/22/2020  -Operations SiteDeleted  
$ConvertAudit = $Audit | Select-Object -ExpandProperty AuditData | ConvertFrom-Json  
$ConvertAudit | Select-Object CreationTime,UserId,Operation,Workload,ObjectID,SiteUrl,SourceFileName,ClientIP,UserAgent  

Result:

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

More information:

https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog?view=exchange-ps

https://www.easy365manager.com/office-365-forensics-using-powershell-and-search-unifiedauditlog/

Answer 2

Use the Unified audit log instead: https://learn.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide