Avoid Getting Blank Results When Searching Office 365 Activity Reports

As you are likely aware Office 365 provides a wealth of abilities to review reports of all the activities that users (and admins) are doing in Office 365.  This is accessible by administrators via the Security & Compliance Center.  You can read more about these reports from Microsoft.  

Activities available for reporting in the Office 365 Security & Compliance Center

Recently we were using this to get download activities from SharePoint but hit a snag when trying to restrict the results to a specific site.  The answer was actually backwards to the interface. 

In the Security & Compliance Center Audit Log search, you can review results for activities by activities, a date range, by user or by filename, folder or site.  In my case, we were trying to view files that had been downloaded by anyone on any library in a specific site.  Easy right?  Wrong!  Do what Microsoft events tell you and paste the full URL of the site (i.e. https://tenant.sharepoint.com/sites/HR) and click search:

Zero results when pasting full URL in audit log search in Office 365

Huh?  That’s not what we’re told:

Filtering the audit log search in Office 365

What that SHOULD say is to use the RELATIVE URL, not the full URL.  In other words, just drop the https://tenant.sharepoint.com from the front.  If you paste the remainder you will get results (i.e. /sites/hr):

image

Thanks Microsoft for the clear messaging!  If you need help figuring out the Security & Compliance Center or the rest of Office 365 just reach out to us, we’re happy to help better understand your tenant!