Auditing configuration is changed by an application other than Change Auditor. When this is detected, the configuration for the tenant will be reset to settings in the Office 365 Exchange Online template.
Directory roles (also known as administrator roles) represent a specific sets of rights within Azure Active Directory. Users access to Azure Active Directory features depends on the roles they have been assigned. The following events are available:
Azure Active Directory and Office 365 Exchange Online keeps track of events that have occurred in the past. Using PowerShell, you can now also collect these events by specifying how many hours or days the agent should go back in time to start event collection.