There's a date mismatch. The roadmap entry gives general availability as December 2025. Microsoft Learn's "What's new in Microsoft 365 Backup" page dates the feature, listed as "Monitor and export Microsoft 365 Backup activity," to October 13, 2026. The Message Center notice also points to an October launch. Message MC1489931 said rollout begins in mid-October 2026 and is expected to complete by mid-October 2026, and the pupuweb archive of the same notice lists Release Start: 15 Oct 2026 Release End: 15 Oct 2026. Microsoft's own documentation and the Message Center both point to October 2026 as the real launch, so the December 2025 roadmap date looks like a placeholder that was never updated.
What the feature does
Microsoft Learn describes Activity Logs as a view of backup policy and restore operations for operational monitoring and troubleshooting. That wording matters. This feature doesn't change how your data is protected or how much of it can be recovered. It shows you what has been done to your backup setup, and when.
According to Microsoft Learn, the logs cover:
- Policy and dynamic rule changes
- Product and protection-unit offboarding
- Restore task creation and completion
Microsoft also says read-only operations aren't included. If someone only browses settings or views a policy without changing it, don't expect an entry.
The Message Center notice describes the data in each entry. It says activity log entries will include metadata such as service, activity type, status, impact, policy or restore task details, timestamps, and the administrator who performed the action. The announcement also promised greater visibility into configuration changes, restore progress, failures, and operational status. Microsoft Learn's list of covered operations is narrower than that. Don't assume every failure or every step of a restore will show up until you've seen it in your own tenant.
Section summary: The logs record changes to backup policies and rules, offboarding, and the start and finish of restore tasks. Read-only actions are not logged.
How to open Activity Logs
The Message Center steps and Microsoft Learn agree on where to find it:
- Go to the Microsoft 365 admin center.
- Open Microsoft 365 Backup.
- Open Reports > Recent activities, then select View more to reach the full Activity logs page.
From there, Microsoft Learn says you can review activity counts and details, filter or search activities, and export the current results to CSV. The Message Center notice says you can filter logs by service, activity type, activity status, impact, and date range and search activity logs using free text.
If you were hoping for an automatic feed, there isn't one documented. Microsoft describes only a manual export of the results currently on screen. Nothing in the documentation mentions scheduled exports, an API stream or a SIEM connector for this view. If you want these records in Sentinel or another log platform, you'll have to export them by hand for now.
Practical workflow: checking a restore that went wrong
Here's a typical use. A SharePoint site restore didn't produce what the site owner expected. Open Activity Logs, filter by service (SharePoint) and by a date range around the incident, then search for the site or the restore task. You should see when the restore task was created and completed and which admin started it. If the site's policy or dynamic rules changed shortly before, that change will be in the same view. Export the filtered results to CSV and attach the file to the ticket.
Section summary: The path is admin center → Microsoft 365 Backup → Reports > Recent activities > View more. You can filter, search and export to CSV, but only manually.
Retention, scale and who can see what
Microsoft Learn gives three fixed limits:
| Item | What Microsoft documents |
|---|---|
| Retention | 365 days, fixed and not configurable |
| Capacity | Up to 1 million activities across supported services |
| Read-only operations | Not logged |
Microsoft doesn't say what happens when you reach the 1 million limit, or exactly what that limit applies to. Large tenants with heavy policy churn should watch for this, but it's unclear for now.
Who can see which logs depends on the admin role:
| Role | Workloads visible |
|---|---|
| Global Administrator | SharePoint, OneDrive, Exchange |
| Microsoft 365 Backup Administrator | SharePoint, OneDrive, Exchange |
| SharePoint Administrator | SharePoint and OneDrive |
| Exchange Administrator | Exchange |
This follows the Message Center summary, which said administrators will only be able to view logs for workloads they are authorized to manage. If an Exchange admin says the log looks empty for a OneDrive restore, that's the role scoping working as designed, not a bug. For least-privilege setups, the Microsoft 365 Backup Administrator role gives full visibility across all three workloads without handing out Global Admin.
Section summary: Logs are kept for one year and you can't change that. What each admin sees depends on their role.
Activity Logs vs. Purview Audit: not the same thing
This is the point most likely to cause confusion. Microsoft Learn says that for compliance investigations that require the Microsoft 365 audit record, you should continue to use Microsoft Purview Audit. The new Activity Logs view is a monitoring and troubleshooting tool. It doesn't replace the unified audit log.
Microsoft 365 Backup operations already appear in Purview Audit. The Purview activity reference lists operations such as BackupPolicyActivated, BackupItemAdded and BackupItemRemoved, and restore-related operations like RestoreTaskActivated. It also lists one read-type event, SiteBrowsedForRestore, logged when a site is browsed to pick items for a granular restore. That kind of read-only action is exactly what the new Activity Logs leave out. If an investigation needs to know who browsed a restore point, Purview is the place to look.
There's another reason to keep Purview in the workflow. Microsoft's Purview documentation notes that Audit (Standard) retention defaults to 180 days. That's different from the fixed 365 days in Activity Logs, so the two sources won't always cover the same time period.
One thing to be careful with: the Message Center notice says CSV exports can support offline review, reporting, and compliance workflows. That's fine for internal reporting. But Microsoft's own documentation says Purview Audit is the source of record for compliance investigations, so don't hand an Activity Logs export to an auditor as the official record.
Section summary: Use Activity Logs for quick operational answers and Purview Audit for the official audit record. Some events, including read-only ones, only appear in Purview.
Why this matters, and what's still missing
Microsoft 365 Backup has added a lot of features this year. Microsoft Learn's changelog shows configurable recovery windows, higher scale limits, generally available granular restore for OneDrive and SharePoint, and two-person approval for shortening the offboarding deletion grace period, all in recent weeks. Several of those are destructive or high-impact actions. Shortening a recovery window, for example, starts a 30-day countdown before older recovery points are deleted. Without an easy way to see who changed what, admins were tracking those changes in Purview searches or in spreadsheets.
Activity Logs fills that gap inside the product. Third-party Microsoft 365 backup vendors have offered built-in activity logs with CSV export for a long time, so Microsoft is catching up here more than leading. Microsoft's advantage is that the logs live in the same console and use the same roles as the backup service.
Gaps worth noting:
- No configurable retention. One year is fixed. If you need longer, export regularly or rely on Purview Audit retention policies.
- Manual export only. No documented automation or API.
- Undefined behavior at the 1 million cap.
- Read-only actions excluded.
What admins should do now
The Message Center notice says no action is required, but a few checks are worth doing:
- Check roles. Make sure the people who troubleshoot backups hold a role that covers the workloads they're responsible for.
- Get a baseline. Open the view, filter by service, and export a CSV so you know what normal activity looks like before you need it in an incident.
- Add it to change reviews. After any recovery window, policy or dynamic rule change, confirm the change shows up in Activity Logs.
- Keep Purview Audit in your runbooks for security or compliance investigations, especially those involving read-only access such as browsing a restore point.
- Archive exports if you need more than 365 days of operational history.
The feature won't change your recovery point objectives, but when someone asks who changed the backup policy, you'll be able to answer from the Backup console.