Warning
Microsoft Stream (Classic) will be retired February 15, 2024 and replaced by Stream (on SharePoint). It is recommended to start using Stream (on SharePoint) by uploading videos to SharePoint, Teams, Yammer, or OneDrive.
Stream (Classic) live events will be retired September 15, 2023 and replaced by Teams live events.
Functionality in Stream (Classic) will be changed and removed leading up to the retirement date. Learn more...
Audit logs in Microsoft Stream (Classic)
You can use audit logs to monitor and investigate actions taken in Stream. Knowing who is taking what action on which item can be critical in helping your organization meet regulatory compliance and records management requirements.
You can filter the audit data by date range, user, dashboard, report, dataset and activity type. You can also download the activities in a CSV (comma separated value) file to analyze offline and use PowerShell to search for audit logs.
Stream (Classic) audit logs are included in the Microsoft 365 audit logs:
To access the auditing section of the Microsoft 365 Security and Compliance portal, you must have an Exchange Online license (included with Microsoft 365 Enterprise E3 and E5 subscriptions).
You must either be a Microsoft 365 Global Admin or have an Exchange admin role that provides access to the audit log.
Exchange admin roles are controlled through the Exchange admin center. For more information, see Permissions in Exchange Online.
If you have access to the audit log but are not a Microsoft 365 Global Admin or a Stream (Classic) admin, you do not have access to the Stream (Classic) admin settings. In this case, use this direct link to the Microsoft 365 Security and Compliance portal audit log.
Note
To view audit logs for Microsoft Stream (Classic) in your Microsoft 365 tenant, you need at least one exchange mailbox license in your tenant.
Go to the Microsoft 365 Security and Compliance portal audit log.
On the Audit log search page, select the criteria for the search.
In the drop-down list for Activities under Search, select one of the Stream (Classic) activities: video activities, group / channel activities or general activities. Select anywhere outside of the selection box to close it.
Select dates in the Start date and End date fields.
The last seven days are selected by default. The date and time are presented in Coordinated Universal Time (UTC) format. The maximum date range that you can specify is 90 days.
Note
Information the user should notice even if skimmingIf you're using the maximum date range of 90 days, select the current time for the Start date. Otherwise, you'll receive an error saying that the start date is earlier than the end date. If you've turned on auditing within the last 90 days, the maximum date range can't start before the date that auditing was turned on.
Select specific users in the Users. Use the username that they sign into Microsoft Stream (Classic) with.
Click Search. After a short time the results are displayed under Results. When the search is finished, the number of results found is displayed.
Note
A maximum of 1000 events are displayed; if more than 1000 events meet the search criteria, the newest 1000 events are displayed.
The results contain the following information about each event returned by the search.
Column Definition Date The date and time (in UTC format) when the event occurred. IP address The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. User The user (or service account) who performed the action that triggered the event. Activity The activity performed by the user. This value corresponds to the activities that you selected in the Activities drop down list. Item The object that was created or modified because of the corresponding activity. For example, the video that was viewed or modified or the user account that was updated. Not all activities have a value in this column. Detail Additional detail about an activity. Not all activities have a value in this column. Note
Select a column header under Results to sort the results. You can sort the results from A to Z or Z to A. Click the Date header to sort the results from oldest to newest or newest to oldest.
View details about an event by selecting the event record in the list of search results. A details page is displayed that contains the detailed properties from the event record. To display additional details, select More information.
The following table provides details on that you may see displayed.
Parameter Definition ObjectId EntityId, if applicable \nVideoId \nGroupId Resource Title The name of the entity, such as Video Title, Group Name, etc. Resource URL The complete path of the entity (video, group, channel) in Microsoft Stream (Classic) Operation For a list of operations, refer to the actions being logged section ClientIp The IP address of the device that was used when the activity was logged. The IP address is displayed in either an IPv4 or IPv6 address format. OrganizationId The tenant ID for your tenant provisioned in Microsoft Stream (Classic)
Actions logged in Stream (Classic)
The following actions are logged.
| Action Name | Definition |
|---|---|
| Created video | Video entity has been created. No video uploaded yet. |
| Edited video | Video metadata has been edited. |
| Deleted video | Video has been deleted. |
| Uploaded video | Video has been uploaded. |
| Downloaded video | Video download happened. |
| Edited video permission | Video permissions were modified |
| Viewed video | A video has been viewed either in the Stream (Classic) portal or via embed |
| Shared video | Video shared via email. |
| Liked video | A user in the organization liked this video |
| Unliked video | A user disliked a video that they previously liked |
| Commented on video | A comment was made on a video |
| Deleted video comment | A comment on a video was deleted |
| Uploaded text track | A subtitle file was uploaded for a video |
| Deleted text track | A subtitle file was deleted for a video |
| Uploaded thumbnail | A custom thumbnail was uploaded for a video |
| Deleted thumbnail | Custom thumbnail was deleted for a video |
| Linked on Video | A video was associated with a Microsoft 365 Group |
| Group view* | A user viewed an M365 group |
| Created group | Microsoft 365 Group was created from Microsoft Stream (Classic) |
| Edited group | Metadata was updated for Microsoft 365 Group |
| Deleted group | A Microsoft 365 Group was deleted from Microsoft Stream (Classic) |
| Edited group memberships | Microsoft 365 Group permissions were edited |
| Channel view* | A user viewed a Stream (Classic) channel |
| Created channel | A new channel was created |
| Edited channel | Channel metadata was edited |
| Deleted channel | Channel was deleted |
| Set channel thumbnail | Logged after thumbnails complete upload |
| Logon | User Logged in to Microsoft Stream (Classic) |
| Edited user settings | User edited their user settings, such as language |
| Edited tenant settings | Admin updated settings in the Stream (Classic) admin center |
| Edited global role assignment | Admin made updates to the global role assignments such as adding/removing stream admins, video uploaders or channel creators. |
| Get transcript* | A user retrieved a Stream (Classic) transcript |
| Get text track* | A user retrieved a Stream (Classic) text track |
| Get video* | A user failed to retrieve a Stream (Classic) video |
*Some Stream (Classic) audit actions are only available in Advanced Audit. That means users must be assigned the appropriate license before these actions are logged in the audit log
Export the Microsoft Stream (Classic) audit log
To export the Microsoft Stream (Classic) audit log to a CSV file, click Export results.
Select either Save loaded results or Download all results.
Use PowerShell to search the log
You can use PowerShell to access the audit logs based on your login. This is done by accessing Exchange Online.
Here is an example of a command to pull Microsoft Stream (Classic) audit log entries:
Note
In order to use the New-PSSession command, your account needs to have an Exchange Online license assigned to it and you need access to the audit log for your tenant.
Set-ExecutionPolicy RemoteSigned
$UserCredential = Get-Credential
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session
Search-UnifiedAuditLog -StartDate 4/01/2018 -EndDate 5/03/2018 -RecordType MicrosoftStream -ResultSize 1000 | Format-Table | More
For more information about connecting to Exchange Online, see Connect to Exchange Online PowerShell.
For more information about parameters and using the Search-UnifiedAuditLog command, see Search-UnifiedAuditLog.
See also
If you're working with security and compliance, you might find this information useful.
Minimize the potential of a data breach or a compromised account by following these recommended security best practices for Microsoft 365.
Learn about which features are available in which subscriptions: Microsoft 365 Security and Compliance portal availability
Stay up to date on the latest with the official blog of the Microsoft 365 Security team.
Visit the Microsoft Trust Center, where we share our commitments and information about security, privacy, and compliance.