365 defender audit log

Question

I was wondering if there is any audit log for 365 defender admin activities.

Eg reviewing who previewed which email from threat explorer, who shared quarantined email with whom.

Cheers

Answer 1

Hi,

You should be able to access the Defender logs via the Defender Portal:

https://security.microsoft.com/

I hope this answers your question.

---------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hi @Sksks0909 ,
As far as I know, you could view who accessed this mailbox by getting the audit logs or mailbox audit logs. However , you can't log which messages are previewed unless the user makes specific modifications to this message.

who shared quarantined email with whom.

I want to know if admin has assigned a quarantine policy to prevent users from managing their own quarantined phishing messages?
Quarantine policies - Office 365 | Microsoft Learn

If not, I would suggest you could use Get-MessageTrace cmdlet to search message data for the last 10 days . Or use message trace in EAC to query mail flow within your organization.
Message trace in the modern EAC in Exchange Online | Microsoft Learn

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.