I'm trying to figure out if there are logs available for actions taken in the Microsoft 365 Admin Center or any of the other Admin Centers. Specifically, I'm interested in records that show:
1. When a billing account was created and which user was responsible.
2. When a subscription was activated or purchased, and who initiated that action.
3 Answers
TechGuru77 is spot on about Purview, but be warned—billing and commerce events can be tricky in the unified audit log. While admin tasks like role changes show up clearly, actions such as creating billing accounts or activating subscriptions might not appear, or they could be hidden under different event names. For long-term tracking, it's wise to export your audit data to a tool like Sentinel or a SIEM, since the native retention is only up to a year, even with an E5 plan.
I'd suggest opening a support ticket with Microsoft to get clarity on this. They should be able to pull that info for you without too much hassle. If it’s not urgent, you can always wait for their response; otherwise, it might be a real hassle to dig it up on your own.
You should check out Purview; that's where these logs are typically found. Just a heads-up though, depending on how old your tenant is, some logging features might not be enabled by default, and your logs won't go back too far. Still, that's a solid starting point!
I feel you! That Admin Center can be a nightmare to navigate. If you're having trouble finding logs, try searching under 'audit logs' in Purview. It can be a bit convoluted, but with some persistence, you might get there!