This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 82%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVS%3C/text%3E%3C/svg%3E)
Is there any way we can see that any of the scripts or codes are running on the M365 tenant?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Vinod Survase Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
You cannot get the actual scripts, but every operation that results in making changes to any of your M365 objects and their properties is audited as part of the Unified audit log. The vast majority of "read-only" operations however are not.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 24%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Hi Vasil Michev
Thanks for answer on this.
Wanted to check if Unified audit log can help this or what else we need to run because I see there any many different actions and options showing but seems not able to find the correct one which I need to select and run the audit search
From below screenshots.
It will depend the actual script. You can search for specific cmdlets, for example Add-MailboxPermission. But with this approach, you need to know beforehand what the script does. If you want to cover the generic scenario of "any script", you need to examine the whole dataset returned.
Hi Vasil Michev
ohk that seems big chunk to go through because If I am running the search then its going to search all operations across tenant and will show it.
Well that's what you are asking for. Without having some prior knowledge of what cmdlets are going to be run, the only way to cover "any of the scripts or codes" is to get the full set of audit logs.
It has been a while, how is everything going?
If you have any update about this issue, please feel free to post back.