Audit Logs

Question

Hi All

I want to provide access to one user for Audit Logs in security.microsoft.com i.e Microsoft 365 defender. I have provided user attack simulation administrator. Experts guide me what level of access is required to fetch audit logs in Microsoft 365 defender

Answer 1

Hi @Roger Roger ,

If you want that user to only view the audit log, you can create a role group and add view-only audit log permission. Then add the user as a member of the new role group.
If user need to manage the audit log, you need to add audit log permission to the group.
(Kindly note: You have to assign the permissions in Exchange Online. )

Here is detailed description for audit logs for your reference: Search the audit log in the Microsoft Purview compliance portal - Microsoft Purview (compliance) | Microsoft Learn

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.