M365 Audit & Governance: set up and run your first audits
Connect SharePoint and your Microsoft 365 tenant – sign in as an administrator or use an App ID – and run the three audits.
M365 Audit & Governance has three audits. Each only reads; changes happen only when you select findings and confirm an action.
| Audit | Connect with | Finds |
|---|---|---|
| Permissions & sharing | SharePoint connection (MFA sign-in or App ID) | Anyone and organization links, guests, "Everyone", site collection administrators, unique permissions down to files |
| Teams, groups & sites | Tenant (Entra ID App ID) | No activity for N days, no owner, disabled owners, a single owner |
| Power Platform | Tenant (Entra ID App ID) | Flows and apps whose owner was deleted or disabled |
1. SharePoint connection (permissions & sharing)
SharePoint → Add connection. Use the admin center address, for example https://contoso-admin.sharepoint.com, and sign in as a SharePoint administrator – the audit can then list every site and OneDrive. An App ID connection with Sites.FullControl.All works too and never expires.
2. Tenant (Teams, groups, sites, Power Platform)
Tenants → Add tenant, then choose how to connect. You can have tenants of both kinds.
Sign in as an administrator (no app registration)
Choose Sign in as an administrator and sign in with your work account – MFA and Conditional Access work as usual. The audits then run with your admin roles:
| To | Your account needs one of |
|---|---|
| Teams, groups and their owners | Groups Administrator, Teams Administrator, SharePoint Administrator, Global Reader, Global Administrator |
| Last activity (usage reports) | Reports Reader, Global Reader, SharePoint / Teams / Exchange Administrator, Global Administrator |
| Add owners | Groups Administrator, Teams Administrator, SharePoint Administrator, Global Administrator |
| Power Automate flows and Power Apps | Power Platform Administrator, Dynamics 365 Administrator, Global Administrator |
| E-mail owners | Nothing extra – e-mails go from your mailbox (or a shared mailbox you may send as) |
The first time, Microsoft may ask to approve "Microsoft Graph Command Line Tools" (Microsoft's own sign-in app, also used by Microsoft Graph PowerShell). A Global Administrator can approve it for everyone by ticking Consent on behalf of your organization. After signing in, the app shows your admin roles and what they allow. Your sign-in is kept on this computer, encrypted for your Windows account.
App ID (unattended)
Best for scheduled audits that must never ask anyone to sign in.
- Entra admin center → App registrations → New registration.
- API permissions → Add → Microsoft Graph → Application permissions:
- audits:
Group.Read.All,User.Read.All,Reports.Read.All - actions:
Group.ReadWrite.All(add owners),Mail.Send(e-mail owners)
- Grant admin consent.
- Certificates & secrets → upload a certificate (recommended) or create a client secret.
- In the app: Tenants → Add tenant, enter the tenant, the Application (client) ID and the certificate or secret. Test shows which permissions are granted.
3. Power Platform with an App ID (once)
Signed in as an administrator? Nothing to do here. With an App ID, Power Platform's admin APIs accept the app only after it is registered as a management application. In PowerShell (Power Platform CLI), as a Power Platform administrator:
pac admin application register --application-id <Application (client) ID>4. Show real names in usage reports
Activity dates come from the Microsoft 365 usage reports. If the tenant hides names in reports, sites can't be matched to their owners: Microsoft 365 admin center → Settings → Org settings → Reports → clear Display concealed user, group, and site names in all reports.
5. Run the audits
Open Sharing, Teams & sites or Power Platform → New audit → Start audit (or Schedule…). Results appear while the audit runs. Click a tile to filter, Export CSV for auditors, and select findings for the actions.
Updated 2026-10-26