I'm trying to figure out if there are logs available for actions performed in the Microsoft 365 Admin Center (or any of the other Admin Centers). For instance, I want to know:
1. Is there a record of when a billing account was created and which user initiated it?
2. Can I see logs for when a subscription was activated or purchased, along with the user responsible for those actions?
2 Answers
VTi-R is spot on about Purview. Just keep in mind that logs for billing and commerce can be a bit hit or miss in the unified audit log. Admin actions like role changes show up fine, but details like who created a billing account or activated a subscription sometimes get lost or are listed under unexpected event names. If you need solid long-term tracking, exporting your audit data to something like Sentinel or a SIEM is a good idea since the retention in Microsoft tops out at a year, even with the E5 plan.
You can check out Microsoft Purview for logging, but just a heads up, not all logging is enabled by default, especially if your tenant is older. The logs you have will only go back a certain distance, so it's definitely worth starting there.
Honestly, finding the logs in that Center can be a nightmare with all the confusing labels. I understand they're trying to cover a lot of data governance and compliance areas, but a little guidance on where exactly to find the logs would be amazing!