How to Enable Auditing in SharePoint Online?

Here are the steps to enable auditing in SharePoint Online:

1. Log in to the SharePoint admin center as a global administrator or SharePoint administrator.
2. Click on “Policies” in the left-hand menu.
3. Click on “Audit log trimming” and select “On” to enable auditing.
4. Click on “Audit log reports” and select “On” to enable audit log reports.
5. Under the “Audit log trimming” section, you can set the number of days to keep audit log data.
6. Under the “Audit log reports” section, you can choose which events to audit. By default, all events are audited.
7. To view audit logs, go to the Office 365 Security & Compliance Center and click on “Search & investigation” in the left-hand menu.
8. Click on “Audit log search” to search for audit log events.
9. Use the search criteria to filter the results and then click on “Search”.

By enabling auditing in SharePoint Online, you can track activity in your SharePoint sites, including file and folder access, user and group permissions changes, and content changes. This can help you detect and investigate suspicious activity and meet regulatory compliance requirements.