Edit

Search audit logs for app management activities and events

  • Article
  • Applies to:
    Microsoft Teams

Microsoft Purview Audit (Standard) in Microsoft 365 lets you log and search the audited activities performed in the various Microsoft 365 services by users and administrators.

Before you can search the audit records, ensure that you complete the following prerequisites:

Search the audit logs for app events in Teams

The audit logs for app events in Teams help you investigate specific actions related to app management by admins. While you can search the logs for a wide-range of actions, the following table lists some such actions that are logged.

Teams app action Activity name in the Portal Description
Installed app AppInstalled An app is installed or added to a Teams client.
Upgraded app AppUpgraded An app is upgraded to its latest version in the catalog.
Uninstalled app AppUninstalled An app is uninstalled or removed from a Teams client.
Published app AppPublishedToCatalog An app is added to the catalog.
Updated app AppUpdatedInCatalog An app is updated in the catalog.
Deleted app AppDeletedFromCatalog An app is deleted from the catalog.
Deleted all organization apps DeletedAllOrganizationApps Deleted all organization apps from the catalog.

For a complete list of Teams activities that are audited, see Teams activities and Shifts in Teams activities.

Note

App events from private channels are also logged as those events are accomplished in Teams and in the standard channels.

To search the audit logs of Teams app activities, follow these steps:

  1. Sign in to Microsoft Purview and go to Solutions > Audit.

  2. On the Audit page, update the following fields as required:

    • Date and time range: Select the start and end dates of the time period for which you want to check the audit logs.
    • Activities: Enter Microsoft Teams activities. From the list, select one or more app activities. To quickly find the Teams activities, you can search for the word Teams activities in the Activities search field.
    • File, folder, or site: Enter file name or a URL or a part of it.
    • Users: Add the users whose audit log you want to search.

  3. Select Search.

    Screenshot that shows how to search for Teams activities in the Microsoft Purview to audit for Teams events.

You can export the searched audit records as a CSV file. For more information, see Export, configure, and view audit logs.

Note

When one of the above activities is performed by a user or admin, Teams generates and stores an audit record. In Audit (Standard), records are retained for 90 days, which means you can search for activities that occurred within the past three months.

Tip

You can commission the custom development of a per-user report to know if a user has blocked or muted a bot. For more information, see Understand who blocked, muted or uninstalled a bot.