Services
Summary
Enable audit log search for SharePoint Online content searches in Microsoft Purview by following the provided instructions. This feature is now generally available and requires enabling 'SearchQueryInitiatedSharePoint' for users. No admin action is needed before the rollout, but reviewing configurations and updating documentation is advised.
Details
By default, searches conducted from various Microsoft 365 entry points into Microsoft SharePoint Online are not collected in the Microsoft Purview audit log search. You may enable these searches to be collected by following these instructions: Step 4: Enable SearchQueryInitiated events in Get started with auditing solutions | Microsoft Learn.
When this will happen:
General Availability (Worldwide, GCC, GCC High, DoD): Available now.
How this will affect your organization:
To capture searches initiated by users against SharePoint online, you must enable SearchQueryInitiatedSharePoint for each user.
What you need to do to prepare:
This rollout will happen automatically by the specified date with no admin action required before the rollout. Review your current configuration to determine the impact for your organization. You may want to notify your users about this change and update any relevant documentation.