check audit log activities are enabled

Question

Hi All,

How can we check if the following audit log activities have been enabled?

SearchQueryInitiatedSharePoint

SearchQueryInitiatedExchange

Please guide me.

Answer 1

Hi @RisingFlight,

Thank you very much for your response and update.

To assist you better, may I verify whether you have enabled SearchQueryInitiated in the mailbox’s AuditOwner actions for the user you want to track?

For example, if you want to check SearchQueryInitiatedSharePoint and SearchQueryInitiatedExchange audit logs for user1, you first need to enable SearchQueryInitiated on that user’s mailbox.

Set-Mailbox <user1@domain> -AuditOwner @{Add="SearchQueryInitiated"}

If you want to check which mailboxes have SearchQueryInitiated enabled, you can run this command below:

Get-Mailbox -ResultSize Unlimited |

  Select DisplayName,UserPrincipalName,AuditOwner |

  Where-Object { $_.AuditOwner -contains 'SearchQueryInitiated' }

This will display all mailboxes where SearchQueryInitiated is enabled.

After that, the user you are tracking must perform a search in Outlook (web or desktop) and on their SharePoint site.

Then in Purview, you can enter the operation name as I suggested previously, or use the event names SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint in the Operation Name field. I tested this approach, and it works successfully on my end. Additionally, you can specify users in the Users field to narrow the search and reduce processing time.

If you prefer to use PowerShell as an alternative method, you can run the command below. It functions similarly to a Purview audit search and uses a 7-day time range:

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations SearchQueryInitiatedSharePoint,SearchQueryInitiatedExchange -UserIds <user1@domain>

This will return the relevant audit events, based on my testing:

I hope this helps. Feel free to give it a try and let me know if it works on your end. I’ll be happy to assist you further.

Warm thanks.

Answer 2

i can see UnifiedAuditLogIngestionEnabled is already set to True in my environment but when i do audit search in purview i dont see any results please guide me.

Answer 3

Hi @RisingFlight,

Welcome to Microsoft Q&A, and thank you very much for reaching out to us.

Based on your description, as I checked, SearchQueryInitiatedSharePoint and SearchQueryInitiatedExchange do not have their own separate “enable” switch. These activities are part of the Unified Audit Log schema, so audit logging must be enabled globally to capture them.

If you want to track these events for specific mailboxes, you can add SearchQueryInitiated to the audit actions for mailbox owners.

To check if Audit logging is enabled, you can run the following command in Exchange Online PowerShell to check if Unified Audit Log ingestion is enabled:

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

If the result is True, audit logging is enabled, and these activities will be captured.

If you want to check for these two activities specifically, you can check it by going to Microsoft Purview portal > Audit and search for the operation names:

SharePointSearchQueryInitiatedand SearchQueryInitiated:

For more information, you can check on this Microsoft Article on how to search for Auditlog and AuditLog Activities here.

I hope this help. If you have any additional questions or concern, kindly let me know. I would love to assist you further.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

To check if the audit log activities for SearchQueryInitiatedSharePoint and SearchQueryInitiatedExchange have been enabled, you can use the following PowerShell command in Exchange Online:

Set-Mailbox <user> -AuditOwner @{Add="SearchQueryInitiated"}

You need to run this command for each user you want to check. If you want to verify the current settings for a specific user, you can retrieve the mailbox settings and look for the AuditOwner property to see if SearchQueryInitiated is listed.

In a multi-geo environment, ensure that you run the command in the correct forest where the user's mailbox is located. If you need to remove the value from a user's mailbox, you can use:

Set-Mailbox -AuditOwner @{Remove="SearchQueryInitiated"}

This will help you manage and verify the auditing of search query activities in both SharePoint and Exchange Online.

---

References:

• Get started with auditing solutions