Investigate an activity in Office 365 Cloud App Security

Office 365 Advanced Security Management is now Office 365 Cloud App Security.

After you turn on Office 365 Cloud App Security, Office 365 Cloud App Security works with your Office 365 audit log. You can use the Activity log page to see potential issues in how your organization is using Office 365.

How to get to the Activity log page

  1. As a global administrator or security administrator, go to https://protection.office.com and sign in using your work or school account.

  2. In the Security & Compliance Center, choose Alerts > Manage advanced alerts.

  3. Choose Go to Office 365 Cloud App Security.

    In the Security & Compliance Center, choose Manage Advanced Alerts to go to Office 365 Cloud App Security

  4. In the navigation bar across the top of the screen, choose Investigate > Activity log.

    In the O365 CAS portal, choose Investigate.

Review and investigate activities

On the Activity log page, you can see a list of various activities that are taking place within your organization using Office 365. You can use filters across the top of the screen to focus on a specific type of activity or a specific user. For example, the following image shows an organization's Office 365 admin account's failed attempts to sign into Office 365:

The activity log in O365 CAS contains details such as failed sign-in attempts by a user account

As you look at each item in the Activity log, you can click the ellipses to find other related activities. For example, you can view other activities of the same type, from the same IP address, or from the same country/region.

You can view information about many other kinds of activities, too. For example, here are some of the activities you can view in the Activity log:

  • Members added to or removed from groups

  • Changes in user licenses

  • Files or folders shared internally or externally

  • Created or deleted sites or site collections

  • Email forwarding rules

Use the Activity log page to get acquainted with how people in your organization are using Office 365 and what issues they might be having along the way.

Related topics

Office 365 Cloud App Security (help and how-to)
Review and take action on Office 365 Cloud App Security alerts

Connect with an expert
Contact us
Expand your skills
Explore training

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×