Contoso Legal LLP

What in the time since 10 Oct 2026, when Office Sentry started reading the audit log is worth confirming with the client: mailboxes opened by an admin, forwarding, rules that forward or delete mail, anyone links, auditing turned off, mailbox exports, malware and mass deletes.

Files and folders deleted, restored, downloaded, moved and copied in SharePoint and OneDrive, newest first. Opening and editing files isn't listed. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

Links created, used and removed, and people given or refused access to files and sites. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

Mail read, changed or deleted by someone other than the mailbox's owner (an admin or a delegate), and mail sent as or on behalf of someone else. Owners reading their own mail aren't listed. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

Inbox rules created, changed or removed, mail forwarding set or removed, and mail flow rules. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

Mailbox, Send As and folder permissions granted or removed, and mailbox exports requested. In the time since 10 Oct 2026, when Office Sentry started reading the audit log.

Everyone who appears above, most active first.

Files OneDrive's sync app downloaded or uploaded whole, counted per person and day. A sudden large download can mean someone took a copy of a library.