Investigate an activity in Office 365 Cloud App Security

Office 365 Advanced Security Management is now Office 365 Cloud App Security.

Evaluation    >

Planning    >

Deployment    >

Utilization   

Start evaluating

Start planning

Start deploying

You are here!

Next steps

Office 365 Cloud App Security works with your Office 365 audit log. With Office 365 Cloud App Security, as a global or security administrator, you can use the Activity log page to see potential issues in how your organization is using Office 365.

How to get to the Activity log page

  1. As a global administrator or security administrator, go to https://protection.office.com and sign in using your work or school account.

  2. In the Security & Compliance Center, choose Alerts > Manage advanced alerts.

  3. Choose Go to Office 365 Cloud App Security.

    In the Security & Compliance Center, choose Manage Advanced Alerts to go to Office 365 Cloud App Security

  4. In the navigation bar across the top of the screen, choose Investigate > Activity log.

    In the O365 CAS portal, choose Investigate.

Review and investigate activities

On the Activity log page, you can see a list of various activities that are taking place within your organization using Office 365. You can use filters across the top of the screen to focus on a specific type of activity or a specific user. For example, the following image shows an organization's Office 365 admin account's failed attempts to sign into Office 365:

The activity log in O365 CAS contains details such as failed sign-in attempts by a user account

As you look at each item in the Activity log, you can click the ellipses to find other related activities. For example, you can view other activities of the same type, from the same IP address, or from the same country/region.

You can view information about many other kinds of activities, too. For example, here are some of the activities you can view in the Activity log:

  • Members added to or removed from groups

  • Changes in user licenses

  • Files or folders shared internally or externally

  • Created or deleted sites or site collections

  • Email forwarding rules

Use the Activity log page to get acquainted with how people in your organization are using Office 365 and what issues they might be having along the way.

Next steps

Expand your skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×