Kurt Shintaku's Blog

This is a phenomenal blog post that describes EVERYTHING about Microsoft 365 logs.

1. What logs exist
2. How to enable logging
3. What levels of audit exist
   (And the licensing requirements for each)
4. Who can access logs
5. What kind of lag time exists for different events
6. How can data be accessed?
7. Office Management API
8. Using Azure Sentinel to ingest logs

And this is just Part 1.  If you need to collect & hunt through Microsoft 365 logs, you need to go through this post.

• Discovering Microsoft 365 Logs within your Organization [ Part 1]
  https://techcommunity.microsoft.com/t5/public-sector-blog/discovering-microsoft-365-logs-within-your-organization-part-1/ba-p/2823682