How to Track User Activity in Microsoft 365

Monitoring user activity in Microsoft 365 offers a window into how people interact with your essential business tools. Whether you’re looking to improve security, ensure compliance, or simply check productivity, being able to track user actions gives you the tools to do so.

Our guide will clarify how Microsoft 365 enables user activity tracking, the limits of those capabilities, and practical ways you can make sense of the information to protect your organisation.

What User Activities Can You Track in Microsoft 365?

With Microsoft 365, you can track a wide range of activities across its suite of products. This includes user sign-ins, email sending and receiving, document collaboration, file sharing, Teams messages and calls, and more.

Tracking these activities helps you understand not only who is using Microsoft 365 but how and when they use it.

Important user activities typically include:

• Login and logout times for Office 365 services
• Email activities such as sent, received, and read counts
• File actions on OneDrive and SharePoint, including views, edits, and downloads
• Microsoft Teams usage, including chat messages, meeting attendance, call durations, and channel participation
• Admin actions like permission changes or configuration updates

Note that this tracking focuses on usage and access patterns rather than intrusive monitoring like keystroke or screen capture. This strikes a balance between oversight and respecting user privacy.

Where to View Microsoft 365 User Activity Reports?

If you have the right admin permissions (often Global Administrator, Exchange Admin, SharePoint Admin, or Reports Reader roles), Microsoft 365 provides built-in dashboards to access user activity reports.

In these interfaces, you can typically review data from the past 7, 30, 90, or even 180 days. Note there is often a 24 to 48 hour delay before recent activity appears in reports.

Microsoft 365 Admin Center

The Admin Center is the main place to view high-level usage reports across your environment. You can track things like email activity, active users, SharePoint usage, Office activations, and Teams engagement in one place.

To access it, log in at admin.microsoft.com, go to Reports, then Usage. From there, you can browse summary dashboards or drill into more detailed reports. If you need to work with the data outside the platform, reports can be exported to Excel or CSV for further analysis.

Microsoft 365 Purview (Compliance) Portal

If you need more detailed tracking, especially for security or compliance, the Purview portal is where you’ll spend most of your time. This is where audit logs live, giving you a record of actions like file access, email activity, permission changes, and admin operations.

You can run searches across specific timeframes, filter by user or activity type, and investigate incidents in more detail than standard usage reports allow. It’s particularly useful for internal investigations, compliance checks, or demonstrating accountability during audits.

PowerShell and Scripts

PowerShell is useful when the built-in reports don’t give you exactly what you need. It allows you to query activity data in a more flexible way, especially when you’re dealing with large datasets or specific audit requirements.

You can pull detailed logs, automate regular reporting, or build custom scripts to track certain behaviours over time. This is often the preferred approach for larger environments or IT teams that need more control over how data is collected and analysed.

Monitoring Microsoft 365 Email Activity

Email activity reports give you a clear view of how your organisation is using email day to day. They help you understand communication patterns, spot unusual behaviour, and keep your environment secure.

You can see how many emails each user has sent, received, and read, which makes it easier to identify heavy usage or sudden spikes in activity. Trends over time are just as useful, giving you a broader picture of how email is being used across the business and whether anything looks out of place.

For deeper analysis, you can export user-level data for auditing or internal reviews. This is particularly useful if you need to investigate suspicious activity, track adoption, or report on usage for compliance purposes.

Monitoring Microsoft Teams Activity

Teams activity reports give you insight into how people are communicating and collaborating across your organisation.

You can track how many messages are being sent in chats and channels, along with how often users are joining meetings, whether scheduled or ad hoc. Reports also show call activity, including audio, video, and screen sharing usage, helping you understand how Teams is being used in practice.

These insights are useful for both security and performance. For example, unusual spikes in messaging or meeting activity can highlight potential issues, while consistent usage trends can show how well Teams is being adopted.

If privacy is a concern, Microsoft 365 also allows you to anonymise user data in reports. This means you can still analyse behaviour and usage patterns without exposing individual identities, which is especially useful for internal reporting or compliance requirements.

How to Access Audit Logs for Detailed Tracking

Microsoft 365 audit logs give you a much deeper level of visibility than standard reports, making them essential for security investigations and compliance.

You can track who accessed or modified files in SharePoint and OneDrive, review activity from guest users and external collaborators, and identify failed login attempts or risky sign-ins. They also capture admin-level actions, such as permission changes or licence updates, which are often key during incident reviews.

Audit logs are available through the Microsoft 365 Purview portal or via PowerShell using commands like Search-UnifiedAuditLog. While the portal is more user-friendly, PowerShell gives you greater flexibility when working with large datasets or running more targeted searches.

Access typically requires elevated permissions, and filtering the data effectively can take some experience. For that reason, it’s worth defining clear use cases in advance, so you’re not searching through large volumes of data without a clear objective.

Privacy and Legal Considerations

While Microsoft 365 provides detailed usage data, it still respects user privacy. Admins cannot see keystrokes, screenshots, or exact device usage beyond signed-in sessions.

It’s important to communicate transparently with employees about monitoring policies and comply with local privacy laws.

Ultimately, monitoring user activity within your organisation is an acceptable form of safeguarding. You should also combine user activity monitoring with reliable backup and data protection solutions such as Microsoft 365 backup to safeguard against accidental deletions and ransomware.

BackupVault Microsoft 365 User Tracking Support

Understanding how to track user activity in Microsoft 365 empowers you to safeguard business data, improve productivity, and maintain compliance with confidence.

If you are experiencing:

• Difficulty extracting detailed, user-specific reports
• Limited visibility into activities on certain apps like Planner
• Complicated audit log interfaces and the need for automation via scripting
• Trouble correlating session login data with user actions across services

Then our experienced team at BackupVault can help. Our robust cloud backups and 24/7 UK-based support also ensure your critical Microsoft 365 data remains protected against loss, while being able to advise and manage your Microsoft 365 environment.

Take the next step in protecting your Microsoft 365 environment by exploring BackupVault’s encrypted, automatic cloud backups offering for Microsoft 365 organisations today.