Search the audit log for user and admin activity in Office 365
The Office 365 audit log is a unified audit log. Why a unified audit log? Because events from most Office 365 services that you're organization subscribes to are recorded in a single audit log that you can search. That means you can search for user and admin activity in these services:
Set up auditing
There's few things you have to do before you can search the Office 365 audit log.
Search the audit log
After you turn on auditing, you search for hundreds of individual types of events from multiple Office 365 services.