Tenant Logs: Sign-ins, Exchange, SharePoint, Teams

Tenant logs: sign-ins, Exchange, SharePoint, Teams

Petra stores and displays activity logs for each tenant—sign-ins, email (Exchange) activity, SharePoint activity, and Teams activity. These logs let you search and filter what happened in the tenant over a period of time, which is essential for investigating incidents or answering questions like "what did this user do last week?" This article explains what tenant logs are and how to use them.

What tenant logs are

Tenant logs are a searchable, filterable view of the activity that Petra has collected from the tenant's Microsoft 365 environment. They're based on the same data that powers incident detection—sign-in events, email access and sends, file access in SharePoint, and activity in Teams. Unlike the incident view, which focuses on a single finding, the logs view lets you look across all activity for a date range, user, or other criteria. That's useful when you're doing a deep dive, verifying a user's story, or building a timeline that isn't tied to a single incident.

Types of logs you'll see

Common log types include: Sign-ins—When users signed in, from where, and with what result (success, failure, conditional access). Exchange—Email-related events such as message access, sends, and deletes. SharePoint—File access, downloads, and sharing. Teams—Activity in Microsoft Teams. You may also see logs for app registrations, auth method changes, directory role assignments, or device registrations, depending on what's enabled for the tenant. Each log type is usually in its own tab or section so you can focus on one category at a time.

How to use the logs

Use the date range picker to limit the period you're looking at. Filter by user (identity) when you're investigating a specific person. Use search or filters to find events that match certain criteria (e.g., failed sign-ins, or access to a specific resource). You can often click a row to see more detail in a sidebar or panel. Export options may be available if you need to pull data into a spreadsheet or report. Tenant logs are your go-to when you need raw activity data rather than a pre-built incident narrative—use them to validate what happened, fill gaps in a timeline, or answer ad-hoc questions from the business or a customer.