Harbour ITMenu

Powered by Office Sentry 2.5.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Northwind Traders

Northwind Traders

Grade E
northwindtraders.onmicrosoft.com
Monthly review

Files and mailbox access

Who deleted, downloaded and shared files, who opened someone else's mailbox, and inbox rules, forwarding and mailbox permissions set up, from the client's Microsoft 365 audit log.

All clients
Download PDFXLSX
Files deleted
134
Last 30 days
Files downloaded
20
Last 30 days
Anyone links created
1
Last 30 days
Mailboxes opened by others
1
Last 30 days
Inbox rules created or changed
1
Last 30 days
Forwarding set
1
Last 30 days
Needs attention 5Files 165Sharing 7Mailboxes opened by someone else 25Inbox rules and forwarding 2Mailbox and folder permissions 2Audit settings 0Who did most 35OneDrive sync 24

Needs attention 5

5 to review CSV

What in the time since 10 Oct 2026, when Office Sentry started reading the audit log is worth confirming with the client: mailboxes opened by an admin, forwarding, rules that forward or delete mail, anyone links, auditing turned off, mailbox exports, malware and mass deletes.

When (UTC)WhatWhoMailbox or personItem
14 Oct 2026, 10:00 highMass deleteolivia.smith@northwindtraders.example130 files in an hour
Why it matters: 130 files deleted within an hour.
16 Oct 2026, 20:10 highMail read by someone elseann.patel@northwindtraders.exampledan.whitaker@northwindtraders.example\Inbox
Why it matters: An admin opened someone else's mailbox.
13 Oct 2026, 16:09 highInbox rule createdrhys.moore@northwindtraders.examplerhys.moore@northwindtraders.exampleInvoices
Why it matters: A rule forwards mail.
12 Oct 2026, 09:43 highMail forwarding changedann.patel@northwindtraders.examplealfie.roberts@northwindtraders.examplealfie.roberts@northwindtraders.example
Why it matters: Mail forwarding was set on a mailbox.
15 Oct 2026, 10:03 mediumAnyone link createdmaya.martin@northwindtraders.example/sites/marketing/Shared Documents/Price list 2027.xlsx
Why it matters: Anyone with the link can open it, without signing in.

Files 165

CSV

Files and folders deleted, restored, downloaded, moved and copied in SharePoint and OneDrive, newest first. Opening and editing files isn't listed. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

When (UTC)WhatWhoFileDetail
16 Oct 2026, 16:34File restoredharry.lee@northwindtraders.example/sites/finance/Shared Documents/Board minutes.docx
16 Oct 2026, 15:38File downloadedreception@northwindtraders.example/sites/marketing/Shared Documents/Supplier contracts.pdf
16 Oct 2026, 14:43File downloadedmia.hughes@northwindtraders.example/sites/finance/Shared Documents/Welcome pack.pptx
16 Oct 2026, 11:14File downloadedthomas.clarke@northwindtraders.example/sites/finance/Shared Documents/Welcome pack.pptx
16 Oct 2026, 08:58File downloadedhannah.robinson@northwindtraders.example/sites/intranet/Shared Documents/Q3 invoices.pdf
15 Oct 2026, 15:03File downloadedzara.jackson@northwindtraders.example/sites/operations/Shared Documents/Price list 2027.xlsx
15 Oct 2026, 14:04File restoredleo.morris@northwindtraders.example/sites/clients/Shared Documents/Welcome pack.pptx
15 Oct 2026, 12:48File downloadedowen.white@northwindtraders.example/sites/marketing/Shared Documents/Holiday planner.xlsx
15 Oct 2026, 11:48File downloadedruby.taylor@northwindtraders.example/sites/finance/Shared Documents/Insurance renewal.pdf
15 Oct 2026, 11:45File downloadedhannah.robinson@northwindtraders.example/sites/clients/Shared Documents/Holiday planner.xlsx
15 Oct 2026, 11:10File deletedhannah.robinson@northwindtraders.example/sites/operations/Shared Documents/Staff rota.xlsx
15 Oct 2026, 10:14File downloadedleo.evans@northwindtraders.example/sites/finance/Shared Documents/Board minutes.docx
15 Oct 2026, 10:06File downloadedrhys.moore@northwindtraders.example/sites/finance/Shared Documents/Welcome pack.pptx
14 Oct 2026, 15:46File downloadedella.baker@northwindtraders.example/sites/intranet/Shared Documents/Onboarding checklist.docx
14 Oct 2026, 14:45File deletedarthur.evans@northwindtraders.example/sites/marketing/Shared Documents/Board minutes.docx
14 Oct 2026, 13:49File deletedruby.hill@northwindtraders.example/sites/operations/Shared Documents/Budget 2027.xlsx
14 Oct 2026, 12:06File movedimogen.edwards@northwindtraders.example/sites/finance/Shared Documents/Budget 2027.xlsxTo Shared Documents/Archive/Budget 2027.xlsx
14 Oct 2026, 11:49File movedjacob.hughes@northwindtraders.example/sites/marketing/Shared Documents/Budget 2027.xlsxTo Shared Documents/Archive/Budget 2027.xlsx
14 Oct 2026, 10:43File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 129.pdf
14 Oct 2026, 10:42File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 126.pdf
14 Oct 2026, 10:42File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 127.pdf
14 Oct 2026, 10:42File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 128.pdf
14 Oct 2026, 10:41File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 123.pdf
14 Oct 2026, 10:41File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 124.pdf
14 Oct 2026, 10:41File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 125.pdf
14 Oct 2026, 10:40File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 120.pdf
14 Oct 2026, 10:40File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 121.pdf
14 Oct 2026, 10:40File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 122.pdf
14 Oct 2026, 10:39File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 117.pdf
14 Oct 2026, 10:39File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 118.pdf
14 Oct 2026, 10:39File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 119.pdf
14 Oct 2026, 10:38File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 114.pdf
14 Oct 2026, 10:38File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 115.pdf
14 Oct 2026, 10:38File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 116.pdf
14 Oct 2026, 10:37File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 111.pdf
14 Oct 2026, 10:37File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 112.pdf
14 Oct 2026, 10:37File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 113.pdf
14 Oct 2026, 10:36File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 108.pdf
14 Oct 2026, 10:36File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 109.pdf
14 Oct 2026, 10:36File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 110.pdf
14 Oct 2026, 10:35File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 105.pdf
14 Oct 2026, 10:35File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 106.pdf
14 Oct 2026, 10:35File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 107.pdf
14 Oct 2026, 10:34File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 102.pdf
14 Oct 2026, 10:34File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 103.pdf
14 Oct 2026, 10:34File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 104.pdf
14 Oct 2026, 10:33File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 099.pdf
14 Oct 2026, 10:33File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 100.pdf
14 Oct 2026, 10:33File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 101.pdf
14 Oct 2026, 10:32File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 096.pdf
14 Oct 2026, 10:32File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 097.pdf
14 Oct 2026, 10:32File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 098.pdf
14 Oct 2026, 10:31File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 093.pdf
14 Oct 2026, 10:31File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 094.pdf
14 Oct 2026, 10:31File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 095.pdf
14 Oct 2026, 10:30File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 090.pdf
14 Oct 2026, 10:30File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 091.pdf
14 Oct 2026, 10:30File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 092.pdf
14 Oct 2026, 10:29File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 087.pdf
14 Oct 2026, 10:29File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 088.pdf
14 Oct 2026, 10:29File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 089.pdf
14 Oct 2026, 10:28File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 084.pdf
14 Oct 2026, 10:28File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 085.pdf
14 Oct 2026, 10:28File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 086.pdf
14 Oct 2026, 10:27File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 081.pdf
14 Oct 2026, 10:27File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 082.pdf
14 Oct 2026, 10:27File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 083.pdf
14 Oct 2026, 10:26File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 078.pdf
14 Oct 2026, 10:26File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 079.pdf
14 Oct 2026, 10:26File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 080.pdf
14 Oct 2026, 10:25File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 075.pdf
14 Oct 2026, 10:25File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 076.pdf
14 Oct 2026, 10:25File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 077.pdf
14 Oct 2026, 10:24File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 072.pdf
14 Oct 2026, 10:24File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 073.pdf
14 Oct 2026, 10:24File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 074.pdf
14 Oct 2026, 10:23File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 069.pdf
14 Oct 2026, 10:23File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 070.pdf
14 Oct 2026, 10:23File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 071.pdf
14 Oct 2026, 10:22File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 066.pdf
14 Oct 2026, 10:22File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 067.pdf
14 Oct 2026, 10:22File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 068.pdf
14 Oct 2026, 10:21File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 063.pdf
14 Oct 2026, 10:21File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 064.pdf
14 Oct 2026, 10:21File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 065.pdf
14 Oct 2026, 10:20File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 060.pdf
14 Oct 2026, 10:20File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 061.pdf
14 Oct 2026, 10:20File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 062.pdf
14 Oct 2026, 10:19File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 057.pdf
14 Oct 2026, 10:19File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 058.pdf
14 Oct 2026, 10:19File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 059.pdf
14 Oct 2026, 10:18File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 054.pdf
14 Oct 2026, 10:18File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 055.pdf
14 Oct 2026, 10:18File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 056.pdf
14 Oct 2026, 10:17File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 051.pdf
14 Oct 2026, 10:17File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 052.pdf
14 Oct 2026, 10:17File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 053.pdf
14 Oct 2026, 10:16File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 048.pdf
14 Oct 2026, 10:16File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 049.pdf
14 Oct 2026, 10:16File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 050.pdf
14 Oct 2026, 10:15File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 045.pdf
14 Oct 2026, 10:15File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 046.pdf
14 Oct 2026, 10:15File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 047.pdf
14 Oct 2026, 10:14File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 042.pdf
14 Oct 2026, 10:14File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 043.pdf
14 Oct 2026, 10:14File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 044.pdf
14 Oct 2026, 10:13File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 039.pdf
14 Oct 2026, 10:13File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 040.pdf
14 Oct 2026, 10:13File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 041.pdf
14 Oct 2026, 10:12File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 036.pdf
14 Oct 2026, 10:12File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 037.pdf
14 Oct 2026, 10:12File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 038.pdf
14 Oct 2026, 10:11File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 033.pdf
14 Oct 2026, 10:11File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 034.pdf
14 Oct 2026, 10:11File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 035.pdf
14 Oct 2026, 10:10File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 030.pdf
14 Oct 2026, 10:10File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 031.pdf
14 Oct 2026, 10:10File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 032.pdf
14 Oct 2026, 10:09File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 027.pdf
14 Oct 2026, 10:09File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 028.pdf
14 Oct 2026, 10:09File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 029.pdf
14 Oct 2026, 10:08File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 024.pdf
14 Oct 2026, 10:08File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 025.pdf
14 Oct 2026, 10:08File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 026.pdf
14 Oct 2026, 10:07File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 021.pdf
14 Oct 2026, 10:07File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 022.pdf
14 Oct 2026, 10:07File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 023.pdf
14 Oct 2026, 10:06File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 018.pdf
14 Oct 2026, 10:06File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 019.pdf
14 Oct 2026, 10:06File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 020.pdf
14 Oct 2026, 10:05File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 015.pdf
14 Oct 2026, 10:05File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 016.pdf
14 Oct 2026, 10:05File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 017.pdf
14 Oct 2026, 10:04File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 012.pdf
14 Oct 2026, 10:04File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 013.pdf
14 Oct 2026, 10:04File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 014.pdf
14 Oct 2026, 10:03File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 009.pdf
14 Oct 2026, 10:03File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 010.pdf
14 Oct 2026, 10:03File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 011.pdf
14 Oct 2026, 10:02File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 006.pdf
14 Oct 2026, 10:02File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 007.pdf
14 Oct 2026, 10:02File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 008.pdf
14 Oct 2026, 10:01File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 003.pdf
14 Oct 2026, 10:01File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 004.pdf
14 Oct 2026, 10:01File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 005.pdf
14 Oct 2026, 10:00File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 000.pdf
14 Oct 2026, 10:00File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 001.pdf
14 Oct 2026, 10:00File deletedolivia.smith@northwindtraders.example/sites/intranet/Shared Documents/Archive 002.pdf
14 Oct 2026, 09:14File downloadedleo.evans@northwindtraders.example/sites/operations/Shared Documents/Q3 invoices.pdf
14 Oct 2026, 08:35File restoredruby.taylor@northwindtraders.example/sites/intranet/Shared Documents/Onboarding checklist.docx
13 Oct 2026, 15:56File restoredleo.wright@northwindtraders.example/sites/clients/Shared Documents/Supplier contracts.pdf
13 Oct 2026, 15:48File deletedowen.taylor@northwindtraders.example/sites/finance/Shared Documents/Supplier contracts.pdf
13 Oct 2026, 15:10File movedgrace.taylor@northwindtraders.example/sites/marketing/Shared Documents/Budget 2027.xlsxTo Shared Documents/Archive/Budget 2027.xlsx
13 Oct 2026, 15:06File downloadedhannah.patel@northwindtraders.example/sites/clients/Shared Documents/Budget 2027.xlsx
13 Oct 2026, 11:47File restoredruby.hill@northwindtraders.example/sites/finance/Shared Documents/Q3 invoices.pdf
12 Oct 2026, 11:33File movedmia.hughes@northwindtraders.example/sites/intranet/Shared Documents/Onboarding checklist.docxTo Shared Documents/Archive/Onboarding checklist.docx
12 Oct 2026, 10:48File downloadedhannah.robinson@northwindtraders.example/sites/marketing/Shared Documents/Price list 2027.xlsx
12 Oct 2026, 10:42File downloadedjacob.hughes@northwindtraders.example/sites/operations/Shared Documents/Supplier contracts.pdf
12 Oct 2026, 10:34File downloadedaaron.watson@northwindtraders.example/sites/marketing/Shared Documents/Holiday planner.xlsx
12 Oct 2026, 10:10File restoredgeorge.roberts@northwindtraders.example/sites/intranet/Shared Documents/Insurance renewal.pdf
11 Oct 2026, 17:53File downloadedruby.taylor@northwindtraders.example/sites/clients/Shared Documents/Supplier contracts.pdf
11 Oct 2026, 16:34File downloadedmegan.lee@northwindtraders.example/sites/marketing/Shared Documents/Welcome pack.pptx
11 Oct 2026, 14:08File downloadedisla.evans@northwindtraders.example/sites/intranet/Shared Documents/Q3 invoices.pdf
11 Oct 2026, 09:52File restoredhannah.patel@northwindtraders.example/sites/clients/Shared Documents/Holiday planner.xlsx
11 Oct 2026, 09:31File downloadedzara.jackson@northwindtraders.example/sites/marketing/Shared Documents/Holiday planner.xlsx

Sharing 7

1 to review CSV

Links created, used and removed, and people given or refused access to files and sites. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

When (UTC)WhatWhoWithItemDetail
16 Oct 2026, 15:04Shared with someoneella.baker@northwindtraders.exampleaccounts@partner.example/sites/clients/Shared Documents/Supplier contracts.pdfGuest
15 Oct 2026, 11:03Shared with someoneisla.evans@northwindtraders.exampleaccounts@partner.example/sites/marketing/Shared Documents/Staff rota.xlsxGuest
15 Oct 2026, 10:03 mediumAnyone link createdmaya.martin@northwindtraders.example/sites/marketing/Shared Documents/Price list 2027.xlsx
14 Oct 2026, 15:10Shared with someonerhys.clark@northwindtraders.exampleaccounts@partner.example/sites/clients/Shared Documents/Onboarding checklist.docxGuest
13 Oct 2026, 17:19Shared with someonemia.hughes@northwindtraders.exampleaccounts@partner.example/sites/marketing/Shared Documents/Holiday planner.xlsxGuest
12 Oct 2026, 17:43Shared with someoneethan.green@northwindtraders.examplej.reid@advisers.example/sites/finance/Shared Documents/Onboarding checklist.docxGuest
11 Oct 2026, 15:54Shared with someoneleo.evans@northwindtraders.examplej.reid@advisers.example/sites/finance/Shared Documents/Staff rota.xlsxGuest

Mailboxes opened by someone else 25

1 to review CSV

Mail read, changed or deleted by someone other than the mailbox's owner (an admin or a delegate), and mail sent as or on behalf of someone else. Owners reading their own mail aren't listed. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

When (UTC)WhatWhoMailboxFoldersHow
16 Oct 2026, 20:10 mediumMail read by someone elseann.patel@northwindtraders.exampledan.whitaker@northwindtraders.example\InboxAs admin, Client=OWA
16 Oct 2026, 16:51Sent on behalf of someone elsecarol.mendes@northwindtraders.examplesophie.smith@northwindtraders.exampleAs delegate
16 Oct 2026, 11:54Sent on behalf of someone elsecarol.mendes@northwindtraders.examplemia.hughes@northwindtraders.exampleAs delegate
16 Oct 2026, 11:15Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
16 Oct 2026, 09:44Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
15 Oct 2026, 17:16Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
15 Oct 2026, 14:06Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
15 Oct 2026, 13:59Sent on behalf of someone elsecarol.mendes@northwindtraders.examplealfie.roberts@northwindtraders.exampleAs delegate
15 Oct 2026, 10:12Sent on behalf of someone elsecarol.mendes@northwindtraders.exampleruby.taylor@northwindtraders.exampleAs delegate
14 Oct 2026, 17:32Sent on behalf of someone elsecarol.mendes@northwindtraders.exampleleo.evans@northwindtraders.exampleAs delegate
14 Oct 2026, 17:13Sent on behalf of someone elsecarol.mendes@northwindtraders.examplebreakglass@northwindtraders.exampleAs delegate
14 Oct 2026, 10:18Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
14 Oct 2026, 09:30Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
13 Oct 2026, 16:14Sent on behalf of someone elsecarol.mendes@northwindtraders.examplerhys.moore@northwindtraders.exampleAs delegate
13 Oct 2026, 16:05Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
13 Oct 2026, 12:56Sent on behalf of someone elsecarol.mendes@northwindtraders.examplegeorge.robinson@northwindtraders.exampleAs delegate
13 Oct 2026, 12:28Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
12 Oct 2026, 15:44Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
12 Oct 2026, 12:36Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
12 Oct 2026, 12:36Sent on behalf of someone elsecarol.mendes@northwindtraders.examplegrace.wilson@northwindtraders.exampleAs delegate
12 Oct 2026, 08:40Sent on behalf of someone elsecarol.mendes@northwindtraders.exampleleo.morris@northwindtraders.exampleAs delegate
11 Oct 2026, 13:26Sent on behalf of someone elsecarol.mendes@northwindtraders.exampleleo.morris@northwindtraders.exampleAs delegate
11 Oct 2026, 11:47Sent on behalf of someone elsecarol.mendes@northwindtraders.examplerhys.clark@northwindtraders.exampleAs delegate
11 Oct 2026, 11:24Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate
11 Oct 2026, 08:58Sent as someone elsecarol.mendes@northwindtraders.exampledan.whitaker@northwindtraders.exampleAs delegate

Inbox rules and forwarding 2

2 to review CSV

Inbox rules created, changed or removed, mail forwarding set or removed, and mail flow rules. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

When (UTC)WhatWhoMailboxRuleWhat it does
13 Oct 2026, 16:09 mediumInbox rule createdrhys.moore@northwindtraders.examplerhys.moore@northwindtraders.exampleInvoicesForwardTo payments@mailbox.example
12 Oct 2026, 09:43 mediumMail forwarding changedann.patel@northwindtraders.examplealfie.roberts@northwindtraders.exampleForwardingSmtpAddress smtp:alfie.roberts@gmail.example

Mailbox and folder permissions 2

CSV

Mailbox, Send As and folder permissions granted or removed, and mailbox exports requested. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

When (UTC)WhatWhoMailboxGiven toAccess
15 Oct 2026, 15:49Folder shareddan.whitaker@northwindtraders.exampledan.whitaker@northwindtraders.example:\Calendarcarol.mendes@northwindtraders.exampleEditor
11 Oct 2026, 14:46Mailbox access grantedann.patel@northwindtraders.exampledan.whitaker@northwindtraders.examplecarol.mendes@northwindtraders.exampleFullAccess

Audit settings 0

None in the window.

Who did most 35

CSV

Everyone who appears above, most active first.

WhoDeletedDownloadedSyncedSharedMailboxesRules and permissions
olivia.smith@northwindtraders.example13000000
zara.jackson@northwindtraders.example0246000
jacob.hughes@northwindtraders.example0131000
rhys.moore@northwindtraders.example0130001
megan.lee@northwindtraders.example0127000
carol.mendes@northwindtraders.example0000240
ethan.green@northwindtraders.example0023100
ruby.hill@northwindtraders.example1022000
reception@northwindtraders.example0122000
sophie.smith@northwindtraders.example0021000
grace.taylor@northwindtraders.example0019000
olivia.scott@northwindtraders.example0017000
ruby.taylor@northwindtraders.example028000
harry.lee@northwindtraders.example008000
arthur.evans@northwindtraders.example105000
hannah.patel@northwindtraders.example012000
hannah.robinson@northwindtraders.example130000
ann.patel@northwindtraders.example000012
grace.wilson@northwindtraders.example003000
imogen.edwards@northwindtraders.example002000
leo.evans@northwindtraders.example020100
mia.hughes@northwindtraders.example010100
alfie.roberts@northwindtraders.example002000
ella.baker@northwindtraders.example010100
isla.evans@northwindtraders.example010100
aaron.watson@northwindtraders.example010000
dan.whitaker@northwindtraders.example000001
george.roberts@northwindtraders.example000000
leo.morris@northwindtraders.example000000
leo.wright@northwindtraders.example000000
maya.martin@northwindtraders.example000100
owen.taylor@northwindtraders.example100000
owen.white@northwindtraders.example010000
rhys.clark@northwindtraders.example000100
thomas.clarke@northwindtraders.example010000

OneDrive sync 24

CSV

Files OneDrive's sync app downloaded or uploaded whole, counted per person and day. A sudden large download can mean someone took a copy of a library.

DayWhoWhatFiles
16 Oct 2026jacob.hughes@northwindtraders.exampleFiles downloaded by OneDrive sync3
16 Oct 2026alfie.roberts@northwindtraders.exampleFiles downloaded by OneDrive sync2
16 Oct 2026ruby.taylor@northwindtraders.exampleFiles downloaded by OneDrive sync5
16 Oct 2026reception@northwindtraders.exampleFiles downloaded by OneDrive sync4
15 Oct 2026ethan.green@northwindtraders.exampleFiles downloaded by OneDrive sync4
15 Oct 2026olivia.scott@northwindtraders.exampleFiles downloaded by OneDrive sync17
15 Oct 2026rhys.moore@northwindtraders.exampleFiles downloaded by OneDrive sync15
15 Oct 2026reception@northwindtraders.exampleFiles downloaded by OneDrive sync18
14 Oct 2026grace.wilson@northwindtraders.exampleFiles downloaded by OneDrive sync3
14 Oct 2026zara.jackson@northwindtraders.exampleFiles downloaded by OneDrive sync22
14 Oct 2026jacob.hughes@northwindtraders.exampleFiles downloaded by OneDrive sync21
14 Oct 2026ruby.taylor@northwindtraders.exampleFiles downloaded by OneDrive sync3
13 Oct 2026megan.lee@northwindtraders.exampleFiles downloaded by OneDrive sync27
13 Oct 2026grace.taylor@northwindtraders.exampleFiles downloaded by OneDrive sync19
13 Oct 2026zara.jackson@northwindtraders.exampleFiles downloaded by OneDrive sync24
13 Oct 2026rhys.moore@northwindtraders.exampleFiles downloaded by OneDrive sync15
12 Oct 2026hannah.patel@northwindtraders.exampleFiles downloaded by OneDrive sync2
12 Oct 2026arthur.evans@northwindtraders.exampleFiles downloaded by OneDrive sync5
12 Oct 2026ethan.green@northwindtraders.exampleFiles downloaded by OneDrive sync19
12 Oct 2026jacob.hughes@northwindtraders.exampleFiles downloaded by OneDrive sync7
11 Oct 2026sophie.smith@northwindtraders.exampleFiles downloaded by OneDrive sync21
11 Oct 2026ruby.hill@northwindtraders.exampleFiles downloaded by OneDrive sync22
11 Oct 2026imogen.edwards@northwindtraders.exampleFiles downloaded by OneDrive sync2
11 Oct 2026harry.lee@northwindtraders.exampleFiles downloaded by OneDrive sync8

From the client's Microsoft 365 audit log, read every night through the audit log add-on. Email subjects are never stored.

Data from Files and mailbox access ().