O365 : Search-UnifiedAuditLog

[CapnPugwash]

Hi,

 

I'm having a play with O365 & the PowerShell auditing cmdlets.

 

Does anyone know how accurate / up to date the auditing data is? Is it in 'real time'

 

A Teacher has set up a Class Notebook for all staff and there is a link to it on all desktops

(the link is "https://myschool-my.sharepoint.com/personal/username_my_domain/Documents/Staff"

 

If I run this script

$DocToAudit = "https://myschool-my.sharepoint.com/personal/username_my_domain/Documents/Staff"

Search-UnifiedAuditLog -StartDate "1/1/2017" -EndDate "30/3/2017" -ObjectIDs $DocToAudit | Select UserIds, CreationDate

 

I get data back... but it doesn't look like many staff are using it!

 

I'm only really interested in who has accessed it, not necessarily uploaded a document or modified it. Am I querying for the wrong things?